“Username or password is incorrect” is bullshit • Hacker News Board

Re: “Username or password is incorrect” is bullshit

#111

Post by bo1024 » Fri, Dec 22, 2017, 2:32 PM UTC

bo1024 wrote: post #57

cdancette wrote: post #32

Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public. So for login: always say "email or password is incorrect". And for register: as he said, always say "we sent you an email to verify your email".

Why? I don't see why it's important to hide existence of a user unless you're allowing people to try multiple logins per second on your site. (I'm not an expert so I am sincerely asking to help me understand.)

Just replying to my own post to say thanks everyone who replied (can't edit the original anymore), I learned and got some good food for thought.

Re: “Username or password is incorrect” is bullshit

#112

Post by tantanel » Fri, Dec 22, 2017, 2:35 PM UTC

IshKebab wrote: post #26

tuxxy wrote: post #18

Earlier quoted context omitted.

The application doesn't know if the username you entered is actually yours or someone else's. You could provide the correct password to your account 'test', but not 'ttest'. The server just tells you to check both instead, it's more semantically correct and offers some security improvements with user enumeration.

It knows if it doesn't exist though. This whole thing is about sites that say "Username or password is wrong" when they know the username is wrong because it doesn't exist!

The message is still not wrong if you think of "or" as the boolean or, not as the boolean xor. The system knows the username is wrong but it doesn't know anything about the password.

Re: “Username or password is incorrect” is bullshit

#113

Post by mnarayan01 » Fri, Dec 22, 2017, 2:45 PM UTC

perfmode wrote: post #97

ryanbrunner wrote: post #91

Earlier quoted context omitted.

Not really. "Default to privacy" is what gives you insane useless UXes like the one in the article, where you're making login (already a frustrating experience) more painful with absolutely zero gain in security. Default to knowing your threat model. Default to balancing security concerns with UX, and make an informed decision instead of blindly following best practices.

I don’t want others to know all of the places where I have accounts. That’s an easy way to be targeted.

The point is that sites generally leak this anyway via signup. With github it's even easier, e.g. https://github.com/someuser -- I looked through my settings and their doesn't appear to be any way to "be invisible", though I could be missing something. When you can do a simple query like that, sacrificing UI at sign-in seems totally pointless.

Re: “Username or password is incorrect” is bullshit

#114

Post by tantanel » Fri, Dec 22, 2017, 2:45 PM UTC

zimbatm wrote: post #53

davrosthedalek wrote: post #44

The title is "bullshit". The real problem is that they leak the information they try not to leak anyway, on a different form. This is a common, but not universal, problem. It's not OK to leak information, even if that information is maybe leaked somewhere else already.

In the GitHub case the handles are public information. Anyone can go to " rel="nofollow">https://github.com/ to verify if it exists. So they trade off usability of a clear error message for no gain at all.

This is true for the username but it's possible to make your email address private on GitHub in which case the message that your email is taken can still be considered an information leak.

Re: “Username or password is incorrect” is bullshit

#115

Post by jorgeleo » Fri, Dec 22, 2017, 2:46 PM UTC

GlitchMr wrote: post #40

I have an argument for "username or password is incorrect" messages: it's possible that the password is correct, username exists but isn't the intended one. Then "password is incorrect" message would be lying, as the issue is actually with a username.

Agree, the pair username, password can be invalid for 2 reasons:

It is the intended user, but the password is wrong

It is the right password, but the user is mistyped

The login screen has no way to know when is one or the other.

The OP wrote a whole article based on the wrong assumption, and since the title is a click bait, it made it to the front page of hacker news.

Sad.

Re: “Username or password is incorrect” is bullshit

#116

Post by delinka » Fri, Dec 22, 2017, 2:49 PM UTC

alephnil wrote: post #94

mdahlstrand wrote: post #80

Earlier quoted context omitted.

Sounds like a great solution - would browsers need to support it? Do you have any resources on implementing it?

Browsers has supported it since the late nineties. The problem are on the practical side. If you ever log in from more than one machine, all must have your private key, and the mechanism for synchronising keys between machines are not there. You have to manually install your key each place. It has also been too hard for most people to make and handle public/private key pairs. Also, if you don't have the private key w…

Chrome already syncs data between platforms. Seems reasonably straightforward to include client certs in that data.

Re: “Username or password is incorrect” is bullshit

#117

Post by mnarayan01 » Fri, Dec 22, 2017, 2:52 PM UTC

gregoriol wrote: post #67

ajuc wrote: post #56

Earlier quoted context omitted.

You mean you log onto John with password 12345 and the website says "Some other user uses this password, but not John"? Seems wrong, somehow.

If you, as a developer, are technically able to check that the password is used by another user, you have failed pretty big at best practices.

Doing it every time a user login failed is probably infeasible if you have even a moderate number of users, but you can presumably do it on an ad hoc basis unless you have a ton of users. Or am I missing something?

Re: “Username or password is incorrect” is bullshit

#118

Post by mnarayan01 » Fri, Dec 22, 2017, 2:58 PM UTC

jdietrich wrote: post #77

bo1024 wrote: post #57

Earlier quoted context omitted.

Why? I don't see why it's important to hide existence of a user unless you're allowing people to try multiple logins per second on your site. (I'm not an expert so I am sincerely asking to help me understand.)

Disclosing the existence of a user increases the success rate of certain attacks. Say I've got a leaked password database for foo.com and know that the user bob@gmail.com uses the password "tomato1". If I try using his credentials to log into bar.com and get the message "username or password is incorrect", I'm just going to try the next user on the list. If I get the message "incorrect password", it makes sense for m…

Any evidence of this being used in the wild, particularly where the attack is only trying password variants if the initial failure indicated the user exists? Not disagreeing with the point, just would be interesting if anyone's seen such an attack.

Re: “Username or password is incorrect” is bullshit

#119

Post by u801e » Fri, Dec 22, 2017, 2:58 PM UTC

alephnil wrote: post #94

mdahlstrand wrote: post #80

Earlier quoted context omitted.

Sounds like a great solution - would browsers need to support it? Do you have any resources on implementing it?

Browsers has supported it since the late nineties. The problem are on the practical side. If you ever log in from more than one machine, all must have your private key, and the mechanism for synchronising keys between machines are not there. You have to manually install your key each place. It has also been too hard for most people to make and handle public/private key pairs. Also, if you don't have the private key w…

> If you ever log in from more than one machine, all must have your private key, and the mechanism for synchronising keys between machines are not there.

I don't think that's good practice. What's better is to have a separate key/certificate per device that's used to access a service. That way, even if one machine is compromised (or stolen), then the user can still use other devices to log in. Also, the service provider can disable certificate log in on a per device rather than a per account basis.

> Also, if you don't have the private key with you, there is no way you can log in to the site.

That's not necessarily true. Some HTTP server software (e.g., nginx) do have the option of requesting/asking for a TLS client certificate rather than requiring one. If one is not provided, then it's still possible to connect and log in. Server side policy can be much more strict in terms of locking the account in case of incorrect credentials or restricting access to certain account features if the client certificate wasn't provided.

Re: “Username or password is incorrect” is bullshit

#120

Post by _asummers » Fri, Dec 22, 2017, 2:59 PM UTC

zimbatm wrote: post #53

davrosthedalek wrote: post #44

The title is "bullshit". The real problem is that they leak the information they try not to leak anyway, on a different form. This is a common, but not universal, problem. It's not OK to leak information, even if that information is maybe leaked somewhere else already.

In the GitHub case the handles are public information. Anyone can go to " rel="nofollow">https://github.com/ to verify if it exists. So they trade off usability of a clear error message for no gain at all.

But to you -- the user entering credentials -- that error message is still accurate. From GitHub's perspective, they don't know which one you entered correctly. It could be argued they should tell you that the username doesn't exist if it doesn't (reasonable with public profile), but in the case of an existing user, this is the only correct error message.