Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid username or password” is a useless security measure

kev.inburke.com

Post reply on HN
Print view View original

161–170 of 188 posts

Re: “Invalid username or password” is a useless security measure

#161

Post by Dylan16807 »

spb wrote: post #92
Someone1234 wrote: post #66

> Consider throttling invalid login attempts by IP address or subnet. Oh hell no. First off that is completely ineffective. Botnets are common and inexpensive. But worse still a lot of users often share a single IP (e.g. university dorms, businesses, public wifi, etc). I agree with the first part of this article (i.e. that it is trivial to "prove" a username is valid, and that worse error responses aren't accomplishi…

> Set no maximum password length (250+ characters) It's important to note that if you take the classical advice to "use bcrypt" ( http://codahale.com/how-to-safely-store-a-password/ ), your password will be effectively truncated at 72 characters.

That's a bug. Bcrypt doesn't truncate, it simply doesn't handle longer passwords. And you can pretty safely use another hash before feeding it into bcrypt.

Re: “Invalid username or password” is a useless security measure

#162

Post by bluehex »

drzaiusapelord wrote: post #145
tacostakohashi wrote: post #3

Leaving security aside, "incorrect username/password" is still the more correct and useful statement. Consider the case where you mistype your username (email). For sites like amazon, gmail, hotmail, yahoo, twitter, etc, it is entirely likely that the mistyped username is somebody else's valid username, you typed the password correctly, and "incorrect password" would hide the problem.

I've worked with a CRM product that allowed non-unique usernames. That's right the usernames could be duplicated, so we had like 10 jsmith's. It would parse the username/password combo, and if one matched, that's who you logged in as. I never got to test what happened when jsmith had the same password as another jsmith. I'm sure the results would have been terrifying and hilarious. Apparently, the history here is tha…

I'm going to guess when a new jsmith comes along and tries to sign up with the same password as another jsmith, you get a helpful 'Sorry, that user name and password combination are already in use.'

:P

Re: “Invalid username or password” is a useless security measure

#163

Post by sscotth »

Someone1234 wrote: post #117
spb wrote: post #92

Earlier quoted context omitted.

> Set no maximum password length (250+ characters) It's important to note that if you take the classical advice to "use bcrypt" ( http://codahale.com/how-to-safely-store-a-password/ ), your password will be effectively truncated at 72 characters.

Fair point. I'd still happily take 72 characters compared to what many sites currently offer. Anything over 30 is the exception not the rule.

If someone can guess the first 72 characters of your password, they probably know the rest. e.g. They have access to your password manager or you are using a common phrase.

I still wouldn't limit a user from entering in a longer password. I'd display a warning if they attempt to enter in a 73+ character password to inform them that passwords longer than 72 characters offer no additional protection.

Re: “Invalid username or password” is a useless security measure

#164

Post by Evolved »

why-el wrote: post #134
Evolved wrote: post #129

Earlier quoted context omitted.

If I tell you that your username is incorrect, am I telling you your password isn't? This would be silly, because if the website is new and I know a password is correct, then I can either find the username out there (if the website is social), or pretend I forgot my username and have them give it to me. Not exactly. Multiple users could obviously have the same password but not the same username. Telling an attacker t…

I mentioned exactly those what I think "some way to narrow it down" is, mainly new websites with significantly less users, websites where its common to have your username known in public, and even websites that allow you to query their APIs for username data.

I guess I don't see how that would matter if the website were new. You still would have to obtain a username list prior to new users signing up (assuming they use the same password as the one you're trying) and even then you're also assuming the website doesn't detect the intrusion and advise users to change their passwords.

Re: “Invalid username or password” is a useless security measure

#165

Post by mittsh »

weinzierl wrote: post #37
tacostakohashi wrote: post #3

Leaving security aside, "incorrect username/password" is still the more correct and useful statement. Consider the case where you mistype your username (email). For sites like amazon, gmail, hotmail, yahoo, twitter, etc, it is entirely likely that the mistyped username is somebody else's valid username, you typed the password correctly, and "incorrect password" would hide the problem.

"You don't exist. Go away." is my personal favourite.

+1 Agreed. Always loved original user messages. Wish OSes were more funny in their alert messages.

Re: “Invalid username or password” is a useless security measure

#166

Post by rdl »

Thinking this is only about security is shortsighted, IMO. There are cases of typo-ing the email address, or entering a non-standard email address, which happens to match another.

ryan@gmail.com -> ryan@gmaail.com probably would have some benefit to UX in saying "email address does not exist", but ryan@gmail.com vs. ryanl@gmail.com both exist.

What I'd probably recommend instead, if you do decide confirming account creation status makes sense, is judging by cookie or IP. If 10.10.10.10 has previously logged in as ryanb@gmail.com, and I enter ryan@gmail.com instead, it might make sense to poke on the email; if I enter ryanb@gmail.com and have an incorrect password, maybe suggest bad password. (of course, if you have a cookie, you might as well pre-fill the login; if you have an IP match, probably not).

The security tradeoff here exists but isn't huge. There are definitely cases where the user benefit (and thus reduced bounce rate) of suggesting error in username or password would make sense. The biggest security issue is confirming "does this account exist at all?", because email addresses tend to uniquely identify users, and you need some other mechanism to prevent this -- either automated (captcha would work) or targeted (in which case it's quite hard).

I'm actually in favor of per-action security checking vs. "logged in or logged out, all or nothing".

Re: “Invalid username or password” is a useless security measure

#167

Post by cgriswald »

darrhiggs wrote: post #53
darrhiggs wrote: post #18

The article misses the point that on many sites this is not a security feature, more a privacy one. I have used the 403 http status rather than 401 in the past for this exact reason. RFC 7231[0] suggests something similar "An origin server that wishes to "hide" the current existence of a forbidden target resource MAY instead respond with a status code of 404 (Not Found)." with RFC 7235[1] suggesting the use of 403. "…

Given that I have received downvotes I'll try more concrete example. Imagine that you start dating a someone and they discover your email, maybe you email them. Now they then take that information and try and log into a site that you do not wish that others know you use, this may be a porn site, it may be a group that you associate yourself with, say even a feminist forum. Now if you respond that it's the wrong passw…

I would rather not work somewhere where they both care what my political views are and would go behind my back to find out instead of just asking me. Likewise, if someone I date starts spying on me this way that's a no either way and I would rather know about it when they try to throw something in my face than unknowingly date a creep.

I do think there is a privacy issue, but I think it is rather minimal and as the sibling poster states, the email address is already exposed.

Re: “Invalid username or password” is a useless security measure

#168

Post by ObligatoryRef »

bluehex wrote: post #162
drzaiusapelord wrote: post #145

Earlier quoted context omitted.

I've worked with a CRM product that allowed non-unique usernames. That's right the usernames could be duplicated, so we had like 10 jsmith's. It would parse the username/password combo, and if one matched, that's who you logged in as. I never got to test what happened when jsmith had the same password as another jsmith. I'm sure the results would have been terrifying and hilarious. Apparently, the history here is tha…

I'm going to guess when a new jsmith comes along and tries to sign up with the same password as another jsmith, you get a helpful 'Sorry, that user name and password combination are already in use.' :P

If they're stupid enough to allow non-unique usernames I wouldn't bet on getting a helpful answer like that :)

Re: “Invalid username or password” is a useless security measure

#169

Post by deciplex »

ObligatoryRef wrote: post #168
bluehex wrote: post #162

Earlier quoted context omitted.

I'm going to guess when a new jsmith comes along and tries to sign up with the same password as another jsmith, you get a helpful 'Sorry, that user name and password combination are already in use.' :P

If they're stupid enough to allow non-unique usernames I wouldn't bet on getting a helpful answer like that :)

Just because the requirement was remarkably dumb doesn't mean the developers that implemented it were.

Re: “Invalid username or password” is a useless security measure

#170

Post by xborns »

As many have said if you simply rate-limit with captcha and block it complicates checking against all emails via bots etc.

This rule doesn't apply well to say the majority of b2b systems that don't have account creations public. Thus now I can phish for users and send them targeted oh reset your password here emails because I harvested them from some other hack. Remember it is not always the password that is the weak link it is the user as well.

So calling it useless is shortsighted, yeah for many basic sites it is simple to say yeah tell them what is wrong. That is why they created the picture login to go with the email to ensure you are logging in on the right site. If anything you aren't sure try forgot password with your email.

Source: Real experience building auth systems for large corps.

Post reply on HN