Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid username or password” is a useless security measure

kev.inburke.com

Post reply on HN
Print view View original

121–130 of 188 posts

Re: “Invalid username or password” is a useless security measure

#121

Post by mikeryan »

tonyarkles wrote: post #76
paublyrne wrote: post #42

Earlier quoted context omitted.

More likely, people won't forget how to spell their email address, or make a mistake in typing it that isn't immediately obvious; they might not remember which of their emails they used to sign up, though, even if they only have a couple. No one else can sign up with an email address that belongs to you.

You'd be surprised... After removing the "type it twice" box during registration, the bounce rate of "welcome" emails went up quite a bit.

But what happened to your conversion rate?

Re: “Invalid username or password” is a useless security measure

#122

Post by volkangurel »

volkangurel wrote: post #119
TheLoneWolfling wrote: post #87

Earlier quoted context omitted.

That will cost you dearly in terms of user retention.

If you have to validate email addresses, which I believe you do, what I suggested doesn't add any more steps so I doubt it would cost anything. To the contrary, given that the initial user signup is so simple (just an email and password), users will be much more likely to complete it compared to other signup forms that require more data. Once they are logged in and on your site, you can gamify whatever portions of th…

Actually I'm wrong about hackernews, you'd need a username, but still, you can choose that after you sign up, and you shouldn't be able to log in with that username, that should only be a public handle for your account on forums, comments, etc.

Re: “Invalid username or password” is a useless security measure

#123

Post by andrewstuart2 »

slg wrote: post #104
xanderjanz wrote: post #75

Earlier quoted context omitted.

You're ignoring that most modern apps will give you rudimentary account access even before you confirm your email address. Which would be difficult to do if that account already exists.

That was the inconvenience I was referring to in my post. Either a new user needs to verify their email before using the site or you need someway to immediately tell the user that an account with that address exists. This process also won't work for the small minority of sites that don't require email adresses. HN is one example. And the entire point is moot for most social sites as it is trivially easy to check for…

> Either a new user needs to verify their email before using the site or you need someway to immediately tell the user that an account with that address exists.

One possible solution to that particular problem: https://news.ycombinator.com/item?id=8683589

> Why bother going through all this email trouble when I can just go to twitter.com/TheUsernameIWantToCheck to see if that user account exists?

I totally agree. Twitter usernames are hardly private information, though. As I said, make sure truly private information is kept private.

Keeping in mind the UX, though, most users may not realize how easily their user id ( email/username, etc.) can be discovered. Seeing the login screen confirm that their username exists but their password is incorrect may in fact scare existing users away.

Determine what's best for your demographics, and ideally A/B test the heck out of it.

Re: “Invalid username or password” is a useless security measure

#124

Post by snowwolf »

andrewstuart2 wrote: post #51

I think the real lesson here is that if emails should remain secret you should not indicate upon signup whether or not a user exists with that email. Always send an email. If that user already exists, make sure the email says "We noticed you're trying to sign up again. If you didn't do this, someone else is trying to sign up for you." If that user doesn't exist, send them the typical signup message. The author has so…

Please don't always send an email. A malicious person can now start signing up every day with a bunch of emails resulting in users who do have an account receiving an email from your site daily/hourly saying "we noticed you're trying to sign up again". At which point they become annoyed with your service and either unsubscribe or delete their account.

Hotmail do this everytime someone tries to reset my password which happens almost daily as I have what turns out to be an account name that is in demand and it's really irritating. And there is nothing I can do to stop someone attempting to reset my password - I have 2 factor switched on so they won't be successful.

Of course you can add more logic in to try and be more intelligent about when the emails are sent, but most sites won't get this right when they can't even store passwords correctly.

Re: “Invalid username or password” is a useless security measure

#125

Post by atakan_gurkan »

The concerns about the denial of service attack, if an exponentially rising delay or similar lockout after a certain amount of login attempts are made, can be simply addressed by emailing an "unlock" email to the registered email address if a lockout takes place. That is, lock the account for 1/2 hours if there are a number of failed logins, but at the same time send an email that will allow logging in, by passing the lockout. Would this be a big security gap?

Re: “Invalid username or password” is a useless security measure

#126

Post by mbesto »

saidajigumi wrote: post #40
mbesto wrote: post #23

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. That's terrible UX. > But there's a tradeoff there between security and UX, I hear you say. I am trying to show you there is no tradeoff; you are choosing between a better user experience and a worse use…

> That's terrible UX. Your complaint is extremely unclear. Could you elaborate? Are you suggesting that websites should allow multiple accounts per email address as a matter of course?

No, my point is that signing up for a service (potentially) for a second time is a really frustrating experience. Why not push the user to reset their password?

Re: “Invalid username or password” is a useless security measure

#127

Post by jluxenberg »

I don't know if it's still the case, but for a long time at Amazon your account identifier was a combination of your email address and password. So you could have two accounts with the same email address and different passwords.

Needless to say, this caused some confusion for users.

Re: “Invalid username or password” is a useless security measure

#128

Post by mbesto »

andrewstuart2 wrote: post #33
mbesto wrote: post #23

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. That's terrible UX. > But there's a tradeoff there between security and UX, I hear you say. I am trying to show you there is no tradeoff; you are choosing between a better user experience and a worse use…

> That's terrible UX. I think the goal when the User is a malicious attacker is for them to have a terrible UX.

Huh? He's suggesting that as a Real User that if you don't whether you have an account at all is to just sign up again. People use multiple emails for different accounts all of the time. How is that not a frustrating experience for the Real User?

Re: “Invalid username or password” is a useless security measure

#129

Post by Evolved »

why-el wrote: post #13

None of the author's recommendations conflict with the practice he is advocating against. I think websites say "Bad combination" not because usernames are treated equally with passwords, but because you don't have a choice but say that. If I tell you that your username is incorrect, am I telling you your password isn't? This would be silly, because if the website is new and I know a password is correct, then I can ei…

If I tell you that your username is incorrect, am I telling you your password isn't? This would be silly, because if the website is new and I know a password is correct, then I can either find the username out there (if the website is social), or pretend I forgot my username and have them give it to me.

Not exactly. Multiple users could obviously have the same password but not the same username. Telling an attacker that the password is correct doesn't narrow down the possible user names it could have, , thus still meaning the attacker must theoratically try all valid username combinations with that password unless they have some way to narrow it down.

Re: “Invalid username or password” is a useless security measure

#130

Post by MiddleEndian »

smt88 wrote: post #113
MiddleEndian wrote: post #107

Earlier quoted context omitted.

This is why I like federated login with the options of Google and Facebook. Why go through the hassle of creating a new password and sending a verification email, when the user can just click a couple buttons to sign in with a service indefinitely? The username can be chosen afterwards and never has to be re-typed.

Many people are paranoid about connecting Google/Facebook to anything. You will lose users if you don't give them a plain username/password option.

I know, but it's so much easier. It's not like I can't look up someones email account manually without federated login, plus then I no longer have to store passwords.

Of course, aside from my own projects, the only service I've seen that exclusively does this is Fancy Hands.

Post reply on HN