Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid username or password” is a useless security measure

kev.inburke.com

Post reply on HN
Print view View original

71–80 of 188 posts

Re: “Invalid username or password” is a useless security measure

#71

Post by crumpled »

andrewstuart2 wrote: post #51

I think the real lesson here is that if emails should remain secret you should not indicate upon signup whether or not a user exists with that email. Always send an email. If that user already exists, make sure the email says "We noticed you're trying to sign up again. If you didn't do this, someone else is trying to sign up for you." If that user doesn't exist, send them the typical signup message. The author has so…

Forcing the user to interact with an email client during the signup process before they've confirmed the availability of a username might be good for security, but it's a horrible way to gain users. That's a very high friction process. I generally agree with this comment, however.

Re: “Invalid username or password” is a useless security measure

#72

Post by marcosdumay »

tetrep wrote: post #30

>99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. While this is true, it's perfectly reasonable to require a captcha before allowing a new account to be created; greatly limiting the speed at which an attacker could enumerate emails. While it's not going…

Well, it's also perfectly fine to require a captcha after one or two failed attempts of login. What achieves the same goal.

(Altough, some real rate limiting is better, except when dealing with a distributed bot. Maybe both.)

Re: “Invalid username or password” is a useless security measure

#73

Post by andrewstuart2 »

slg wrote: post #61
andrewstuart2 wrote: post #51

I think the real lesson here is that if emails should remain secret you should not indicate upon signup whether or not a user exists with that email. Always send an email. If that user already exists, make sure the email says "We noticed you're trying to sign up again. If you didn't do this, someone else is trying to sign up for you." If that user doesn't exist, send them the typical signup message. The author has so…

Security is all about trade-offs. Sending emails puts a bigger barrier between signup and first sign in. It is probably a better business move to slightly inconvenience some existing customers rather than slightly inconvenience all potential new customers.

What I'm saying is that every "signup" event should appear as if it was a valid, brand-new signup as far as the web user is concerned.

The email will be sent regardless. If it's a valid new signup, then the user gets a transparent experience. If the user has already signed up, send them a helpful "hey, you've already signed up" message in their inbox.

In case it was an attacker, maybe check the IP against known IPs that have had valid logins. If it's a new IP, add a section to the email message that a potential attacker may be trying to login and that no action is required, etc. Whatever fits your business case.

Re: “Invalid username or password” is a useless security measure

#74

Post by [deleted] »

Someone1234 wrote: post #66

> Consider throttling invalid login attempts by IP address or subnet. Oh hell no. First off that is completely ineffective. Botnets are common and inexpensive. But worse still a lot of users often share a single IP (e.g. university dorms, businesses, public wifi, etc). I agree with the first part of this article (i.e. that it is trivial to "prove" a username is valid, and that worse error responses aren't accomplishi…

[deleted]

Re: “Invalid username or password” is a useless security measure

#75

Post by xanderjanz »

andrewstuart2 wrote: post #73
slg wrote: post #61

Earlier quoted context omitted.

Security is all about trade-offs. Sending emails puts a bigger barrier between signup and first sign in. It is probably a better business move to slightly inconvenience some existing customers rather than slightly inconvenience all potential new customers.

What I'm saying is that every "signup" event should appear as if it was a valid, brand-new signup as far as the web user is concerned. The email will be sent regardless. If it's a valid new signup, then the user gets a transparent experience. If the user has already signed up, send them a helpful "hey, you've already signed up" message in their inbox. In case it was an attacker, maybe check the IP against known IPs t…

You're ignoring that most modern apps will give you rudimentary account access even before you confirm your email address. Which would be difficult to do if that account already exists.

Re: “Invalid username or password” is a useless security measure

#76

Post by tonyarkles »

paublyrne wrote: post #42
tacostakohashi wrote: post #3

Leaving security aside, "incorrect username/password" is still the more correct and useful statement. Consider the case where you mistype your username (email). For sites like amazon, gmail, hotmail, yahoo, twitter, etc, it is entirely likely that the mistyped username is somebody else's valid username, you typed the password correctly, and "incorrect password" would hide the problem.

More likely, people won't forget how to spell their email address, or make a mistake in typing it that isn't immediately obvious; they might not remember which of their emails they used to sign up, though, even if they only have a couple. No one else can sign up with an email address that belongs to you.

You'd be surprised... After removing the "type it twice" box during registration, the bounce rate of "welcome" emails went up quite a bit.

Re: “Invalid username or password” is a useless security measure

#77

Post by tracker1 »

shabble wrote: post #59
tracker1 wrote: post #21

Earlier quoted context omitted.

I don't see how what you say is really true in a system with properly hashed/salted passwords. SELECT "Id", "Hash", "Salt" FROM USERS WHERE "Email" = $input if (results.length == 0) return -1; //No record, bad user, return early... if (results["Hash"] != Hash(pwd.trim(), results["Salt"]) return -2; //invalid password

If you have an index on your "Email" field in the database, there may be discernible difference between the time taken to check the index and return '0 rows', vs getting a match and actually reading the appropriate data to build the result row. I don't know if there's a solution to that in the general scheme of things, other than making the variance of query times between no user and some user as small as possible.

And, if you're returning the correct error message, it doesn't matter.. the whole point of a timing attack is to determine the difference.

IMHO usability is more important. There are other ways to improve security. Rate limiting with < N failed attempts via an IP in under < X minutes.

Re: “Invalid username or password” is a useless security measure

#78

Post by higherpurpose »

andrewstuart2 wrote: post #51

I think the real lesson here is that if emails should remain secret you should not indicate upon signup whether or not a user exists with that email. Always send an email. If that user already exists, make sure the email says "We noticed you're trying to sign up again. If you didn't do this, someone else is trying to sign up for you." If that user doesn't exist, send them the typical signup message. The author has so…

If you're only giving the message when the username doesn't exist, wouldn't that mean the attacker would know when the username does exist?

Re: “Invalid username or password” is a useless security measure

#79

Post by kylequest »

Silly rant... It would be more useful to explore why a service/site would like to 'hide' user names... and how it should be done.

If a site/service needs to hide user names then it needs to do a better job with signups. It's possible to hide user names / emails during signups too and say: "if you already have an account you'll get a reset password link otherwise welcome message from us".

Re: “Invalid username or password” is a useless security measure

#80

Post by TheLoneWolfling »

Someone1234 wrote: post #66

> Consider throttling invalid login attempts by IP address or subnet. Oh hell no. First off that is completely ineffective. Botnets are common and inexpensive. But worse still a lot of users often share a single IP (e.g. university dorms, businesses, public wifi, etc). I agree with the first part of this article (i.e. that it is trivial to "prove" a username is valid, and that worse error responses aren't accomplishi…

Exponential backoffs also have the problem that it makes it far easier to lock someone out of their account. Or rather, it makes it possible to lock someone out of their account for an arbitrary amount of time.

> When a password is set check it isn't in a common password dictionary

I agree with this with short passwords. But for passphrases? No. I find it rather frustrating that (ex) diceware passwords are often rejected as too insecure or flagged with a nasty warning.

Post reply on HN