Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid username or password” is a useless security measure

kev.inburke.com

Post reply on HN
Print view View original

81–90 of 188 posts

Re: “Invalid username or password” is a useless security measure

#81

Post by tracker1 »

Someone1234 wrote: post #66

> Consider throttling invalid login attempts by IP address or subnet. Oh hell no. First off that is completely ineffective. Botnets are common and inexpensive. But worse still a lot of users often share a single IP (e.g. university dorms, businesses, public wifi, etc). I agree with the first part of this article (i.e. that it is trivial to "prove" a username is valid, and that worse error responses aren't accomplishi…

I have to agree with the parent here... There are other ways to add security, and having an obscure error message doesn't really improve things by as much as the error message can cause real users to go down the wrong path.

Re: “Invalid username or password” is a useless security measure

#82

Post by tokenizerrr »

mlrtime wrote: post #16

It is very annoying that visiting a site that you know you have an account on but cannot remember your username. The rate limiting feature seems to solve most of the issues with giving the user a chance at some feedback.

They should allow login by email instead of username

Re: “Invalid username or password” is a useless security measure

#83

Post by Akkuma »

btilly wrote: post #5
NoPiece wrote: post #4

Earlier quoted context omitted.

There are privacy issues though. Take a known email address, run it through 100 sites, and find to find out what kind of sites the person uses.

The point of the article is that you already can do this very easily - just try to sign up to each site.

Gmail allows you to use email+whatever. A lot of sites actually support this and this means it becomes significantly harder to determine what sites you use as each email+whatever is considered unique.

Re: “Invalid username or password” is a useless security measure

#84

Post by bengali3 »

andrewstuart2 wrote: post #73
slg wrote: post #61

Earlier quoted context omitted.

Security is all about trade-offs. Sending emails puts a bigger barrier between signup and first sign in. It is probably a better business move to slightly inconvenience some existing customers rather than slightly inconvenience all potential new customers.

What I'm saying is that every "signup" event should appear as if it was a valid, brand-new signup as far as the web user is concerned. The email will be sent regardless. If it's a valid new signup, then the user gets a transparent experience. If the user has already signed up, send them a helpful "hey, you've already signed up" message in their inbox. In case it was an attacker, maybe check the IP against known IPs t…

>If the user has already signed up, send them a helpful "hey, you've already signed up" message in their inbox.

Well put. Im also a fan of 'If this wasn't you, click here' link within the email to more positively ID the request as malicious

Re: “Invalid username or password” is a useless security measure

#85

Post by darrhiggs »

dllthomas wrote: post #60
darrhiggs wrote: post #53

Earlier quoted context omitted.

Given that I have received downvotes I'll try more concrete example. Imagine that you start dating a someone and they discover your email, maybe you email them. Now they then take that information and try and log into a site that you do not wish that others know you use, this may be a porn site, it may be a group that you associate yourself with, say even a feminist forum. Now if you respond that it's the wrong passw…

It is certainly the case that there is a privacy issue here. However, that doesn't substantially undermine the strongest point presented in the article - that the email is already exposed, usually by refusing to create a new account if one exists with that email and it's sometimes also reported when you ask for a password reset email. I agree with you that the thing to do is fix those issues, though, rather than aban…

I think that could also be solved relatively easily. Just flash that you are sending an account activation email to the person trying to create an account and email the already registered user with a notification that someone tried to sign up with their email address.

Re: “Invalid username or password” is a useless security measure

#87

Post by TheLoneWolfling »

volkangurel wrote: post #68

It's only useless if the website reveals the username elsewhere, but that doesn't have to be the case. Consider the case when the primary usernames are always emails (many sites do this), and signing up for an account is simply done with entering an email and a password. Then, when someone submits a signup form, the website can: - Check if an account with the email exists, and if it does, whether the given password m…

That will cost you dearly in terms of user retention.

Re: “Invalid username or password” is a useless security measure

#88

Post by kevinburke »

andrewstuart2 wrote: post #51

I think the real lesson here is that if emails should remain secret you should not indicate upon signup whether or not a user exists with that email. Always send an email. If that user already exists, make sure the email says "We noticed you're trying to sign up again. If you didn't do this, someone else is trying to sign up for you." If that user doesn't exist, send them the typical signup message. The author has so…

Thanks for this. I updated the post to add this as a possibility.

This adds more friction in the signup process than I'd be willing to accept, but it does solve the information disclosure problem.

Re: “Invalid username or password” is a useless security measure

#89

Post by randall »

xanderjanz wrote: post #75
andrewstuart2 wrote: post #73

Earlier quoted context omitted.

What I'm saying is that every "signup" event should appear as if it was a valid, brand-new signup as far as the web user is concerned. The email will be sent regardless. If it's a valid new signup, then the user gets a transparent experience. If the user has already signed up, send them a helpful "hey, you've already signed up" message in their inbox. In case it was an attacker, maybe check the IP against known IPs t…

You're ignoring that most modern apps will give you rudimentary account access even before you confirm your email address. Which would be difficult to do if that account already exists.

This is the actual concern. If you require an email check before someone messes around with the product, there's a potential dropoff that people can (rightly) be concerned about.

Re: “Invalid username or password” is a useless security measure

#90

Post by tracker1 »

baddox wrote: post #63
csallen wrote: post #58

Earlier quoted context omitted.

Which doesn't matter, because there's no point in keeping usernames secret (and thus no point providing a captcha) unless those usernames are email addresses, in which case it's unlikely that the username you want will be taken.

Strictly speaking, keeping the existence of usernames secret does make brute forcing username/password combinations more difficult.

Only if the returned error code timing for a bad username overalps bad password most of the time. Displaying an obscured error only serves to harm the real users and is of little benefit to the system.

Unless you delay all failed attempts to login by a random time of 500-2000 ms, it's unlikely you'll see much improvement in response rates... having such a random delay is probably helpful anyhow.

Post reply on HN