“Username or password is incorrect” is bullshit
hackernoon.com
“Username or password is incorrect” is bullshit
1–10 of 170 posts
Re: “Username or password is incorrect” is bullshit
#2I like the dramatic style this opinion is written.
Re: “Username or password is incorrect” is bullshit
#3Isn't the other reason so that adversaries can't tell if a particular username/email has signed up? This is not so useful for something like github, sure, but certainly is useful for the more embarrassing sites where users have an expectation the site won't leak their membership.
So in some ways I've always thought of this as a privacy concern rather than a security one?
Edit: I guess I'm thinking purely of emails where you don't get availability checkers during sign up.
Re: “Username or password is incorrect” is bullshit
#4Even if this doesn’t increase security, you should still do it in the hope the user will check the username they’ve just typed as well as retyping the password.
Re: “Username or password is incorrect” is bullshit
#5Isn't the other reason so that adversaries can't tell if a particular username/email has signed up? This is not so useful for something like github, sure, but certainly is useful for the more embarrassing sites where users have an expectation the site won't leak their membership. So in some ways I've always thought of this as a privacy concern rather than a security one? Edit: I guess I'm thinking purely of emails wh…
As the post demonstrates, you simply go to the login form to validate the presence of accounts.
Few sites remember to anonymize that, which might be the real PSA: in such a case, if you require an email confirmation anyway, just send the "recover password" email internally, but let it look like the regular sign-up flow.
If you don't requite email confirmation, anonymous membership isn't possible (just try to sign up with that account, what is the site supposed to do that looks legit without giving away information?)
Re: “Username or password is incorrect” is bullshit
#6The article explains how to do it properly at the end:
> To prevent attackers from knowing whether an account exists or not your signup must only take an email address and provide no feedback in the UI if the sign up succeeded or not. Instead the user would receive an email saying they’re signed up.
Is this not also part of the various 'best practices'? (I confess I don't read too many of them!)
Re: “Username or password is incorrect” is bullshit
#7100% agreed.
Re: “Username or password is incorrect” is bullshit
#8It's still good advice for software where there is no public signup, such as SaaS where accounts are created by administrators.
Re: “Username or password is incorrect” is bullshit
#9> Even if reCAPTCHA was perfect, a hacker could manually validate their usernames of interest by trying to sign up, then automate an attack on the sign in page.
Why is imperfect reCAPTCHA worthless? Do sign up pages even allow brute forcing of usernames (once validated)?
Is he suggesting to fix sign up pages, or to allow brute forcing usernames on login?
His writing style is dramatic, but the arguments are very weak.
Re: “Username or password is incorrect” is bullshit
#10Even if this doesn’t increase security, you should still do it in the hope the user will check the username they’ve just typed as well as retyping the password.
Why? Why not just tell the user what is actually wrong?