In A Perfect World, This Is How Web Sites Would Handle Login Forms
1–10 of 17 posts
Re: In A Perfect World, This Is How Web Sites Would Handle Login Forms
#2It's a good UI, however if not done right it can be potentially dangerous. As you mention in the PS, people can abuse it in various different ways. Spam bots can go around websites that use this practice and check email validity, for example.
Re: In A Perfect World, This Is How Web Sites Would Handle Login Forms
#3Whatever you do, DON'T follow this advice. It's utterly wrong.
Here's the professional way to do this:
"An application should respond with a generic error message regardless of whether the user ID or password was incorrect. It should also give no indication to the status of an existing account."
Re: In A Perfect World, This Is How Web Sites Would Handle Login Forms
#4This is a terrible idea. At this rate, you're just handing out your data! It is a matter of practicality and security. When someone enters a username and password, you do not know who may be on the other end. Telling them that the username is correct but the password is wrong puts an attacker one step closer to gaining access.
Re: In A Perfect World, This Is How Web Sites Would Handle Login Forms
#5In my perfect world signing up to a service would only need my email address. I'd enter it and the service would email me a link. Clicking that link would log me in. No password necessary. My log in credentials would be available everywhere my email is available (which is everywhere), and if I accidentally delete the email then just filling in the "sign up" box with the same email address would email me a new one.
The downside is that if my email account is compromised then my account with the service is also compromised, but if that's the case then most 'forgotten password' systems would be equally broken.
Re: In A Perfect World, This Is How Web Sites Would Handle Login Forms
#6Whatever you do, DON'T follow this advice. It's utterly wrong. Here's the professional way to do this: "An application should respond with a generic error message regardless of whether the user ID or password was incorrect. It should also give no indication to the status of an existing account." https://www.owasp.org/index.php/Authentication_Cheat_Sheet
Bare in mind that particular advice is from a group expressly interested in security. The article is talking about usability. There is often a balance to be struck.
Re: In A Perfect World, This Is How Web Sites Would Handle Login Forms
#7No, in a perfect world, THIS is how web sites would handle login forms:
Re: In A Perfect World, This Is How Web Sites Would Handle Login Forms
#8This is a terrible idea. At this rate, you're just handing out your data! It is a matter of practicality and security. When someone enters a username and password, you do not know who may be on the other end. Telling them that the username is correct but the password is wrong puts an attacker one step closer to gaining access.
Came to the comments to say this. Glad to see I'm not the only one thinking it.
Re: In A Perfect World, This Is How Web Sites Would Handle Login Forms
#9In a perfect world, you don't login at all because your device knows your identity and there are standardized identity federation protocols that applications and devices can participate in.
(Android already has this. Android developers: Please use AccountManager. I am highly unlikely to create an account with you.)
I can't count the number of times I've just "oh well, nevermind" when I couldn't remember the stupid credentials I used with some application, or couldn't be bothered to create new ones. Not to mention the well-documented security problems with asking users to manage passwords.
Blech I say. Blech. I'm sad that it's 2014 and this is still unsolved.
Re: In A Perfect World, This Is How Web Sites Would Handle Login Forms
#10Whatever you do, DON'T follow this advice. It's utterly wrong. Here's the professional way to do this: "An application should respond with a generic error message regardless of whether the user ID or password was incorrect. It should also give no indication to the status of an existing account." https://www.owasp.org/index.php/Authentication_Cheat_Sheet
I second that. It's preferable to not give any indication about which emails are or are not stored in your database.