“Invalid username or password” is a useless security measure
kev.inburke.com
“Invalid username or password” is a useless security measure
1–10 of 188 posts
Re: “Invalid username or password” is a useless security measure
#2Indeed, the assumption that usernames should be secret is stupid and senseless. Passwords are meant to be secret. Emails and usernames are not. Heck, emails would be public, were it not for spam issues.
Re: “Invalid username or password” is a useless security measure
#3Leaving security aside, "incorrect username/password" is still the more correct and useful statement.
Consider the case where you mistype your username (email). For sites like amazon, gmail, hotmail, yahoo, twitter, etc, it is entirely likely that the mistyped username is somebody else's valid username, you typed the password correctly, and "incorrect password" would hide the problem.
Re: “Invalid username or password” is a useless security measure
#4Indeed, the assumption that usernames should be secret is stupid and senseless. Passwords are meant to be secret. Emails and usernames are not. Heck, emails would be public, were it not for spam issues.
There are privacy issues though. Take a known email address, run it through 100 sites, and find to find out what kind of sites the person uses.
Re: “Invalid username or password” is a useless security measure
#5Indeed, the assumption that usernames should be secret is stupid and senseless. Passwords are meant to be secret. Emails and usernames are not. Heck, emails would be public, were it not for spam issues.
There are privacy issues though. Take a known email address, run it through 100 sites, and find to find out what kind of sites the person uses.
The point of the article is that you already can do this very easily - just try to sign up to each site.
Re: “Invalid username or password” is a useless security measure
#6Even simpler than trying to sign up for a new account, many sites will tell you if you enter an unregistered email on their "forgot password" page.
Re: “Invalid username or password” is a useless security measure
#7This doesn't address timing attacks, which are why this is done in the first place. If the code checks only for a username existing and returns the error message, this takes a measurably different amount of time compared to then also looking up if the password matches.
The error shown isn't to dissuade people from using web pages to try to gain access to accounts - it's because the raw code itself doesn't know which is which, and writing code that does enables fast-paced timing attacks.
Re: “Invalid username or password” is a useless security measure
#8Earlier quoted context omitted.
There are privacy issues though. Take a known email address, run it through 100 sites, and find to find out what kind of sites the person uses.
The point of the article is that you already can do this very easily - just try to sign up to each site.
Which is an easily fixed flaw, when it comes to emails.
Usernames, yeah, you're not going to keep those private. But sometimes account names are not the same as display names, and display names can be duplicates, while account names should be reasonably protected.
Re: “Invalid username or password” is a useless security measure
#9Excellent point. However, I think username / password will be (at least partially) replaced by this:
https://passwordless.net/ - Token based authentication
Re: “Invalid username or password” is a useless security measure
#10Even simpler than trying to sign up for a new account, many sites will tell you if you enter an unregistered email on their "forgot password" page.
Yes, but that also alerts any valid account with an unexpected password reset.