Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Username or password is incorrect” is bullshit

hackernoon.com

Post reply on HN
Print view View original

121–130 of 170 posts

Re: “Username or password is incorrect” is bullshit

#121

Post by testvox »

stordoff wrote: post #110
perfmode wrote: post #97

Earlier quoted context omitted.

I don’t want others to know all of the places where I have accounts. That’s an easy way to be targeted.

That's the point of the article though - for a large percentage of services, if you know the username/email address you are targeting, you can just try to register them and see if it works. Obfuscating the login process makes little difference.

Which is why they shouldn't leak this information on the registration page... Instead they should pretend the registration always succeeds and then disallow login until the email has been verified.

Re: “Username or password is incorrect” is bullshit

#122

Post by sp332 »

pornel wrote: post #71

The right answer isn't a blanket "sites should do this super-secret e-mail-only shuffle and not tell you anything". First, you should define your threat model: which information is considered secret and which isn't, and treat any violations as security vulnerabilities. If usernames are public by design, then don't hide them in one form, and expose in URLs elsewhere on the site. If exposing who's registered on your si…

Right, for example if you run an email service, your usernames (addresses) should be hidden. That's because a spammer could use your login page to find valid usernames and then send spam to them. They don't have to guess passwords to cause damage.

Re: “Username or password is incorrect” is bullshit

#123

Post by cjwhite »

ryanbrunner wrote: post #91
pqh wrote: post #85

Earlier quoted context omitted.

default to privacy though, please

Not really. "Default to privacy" is what gives you insane useless UXes like the one in the article, where you're making login (already a frustrating experience) more painful with absolutely zero gain in security. Default to knowing your threat model. Default to balancing security concerns with UX, and make an informed decision instead of blindly following best practices.

You're missing the point. Fix the signup form instead of just giving up.

Re: “Username or password is incorrect” is bullshit

#124

Post by ballenf »

pornel wrote: post #71

The right answer isn't a blanket "sites should do this super-secret e-mail-only shuffle and not tell you anything". First, you should define your threat model: which information is considered secret and which isn't, and treat any violations as security vulnerabilities. If usernames are public by design, then don't hide them in one form, and expose in URLs elsewhere on the site. If exposing who's registered on your si…

The other right answer is do not let someone create an account with an email they don't have access to.

My short gmail address gets a signup on some random website a couple times a month and they're often nigh unto impossible to delete.

Fitbit is one of the worst for this.

Re: “Username or password is incorrect” is bullshit

#126

Post by skywhopper »

This is a pointless argument because I doubt Github or anyone who uses this message seriously considers it to be a security measure. Github's usernames are absolutely public. But they also have so many users that I suspect the wrong username is typed all the time. So yes, sometimes maybe the username is wrong.

Re: “Username or password is incorrect” is bullshit

#127

Post by tzs »

icebraining wrote: post #64
tzs wrote: post #52

Earlier quoted context omitted.

> 2. Email and password for registration. On registration send confirmation email. This opens up a different problem. It should be: 2. Email only for tentative registration. On tentative registration, send confirmation email. 3. User clicks link in confirmation email, which takes to page for setting password. (Alternatively, confirmation email includes randomly generated initial password, user is required to change i…

You should definitively set the password after clicking the link. That said, what would an attacker do with that account?

Suppose it were a social media site. Now that attacker has a working account with someone else's email address, and that email address is considered verified by the site.

The attacker could then use that account to post threats, harass people, and so on. If he goes far enough that either law enforcement wants to come after him or someone wants to sue him and the site is served with a warrant to reveal information about the poster what they are going to cough up is the verified email address of the account holder.

That will be followed to the email provider, and from there to the email address holder. The email holder's claims that he never made the social media account are going to sound unconvincing--he clicked the confirm link to make the account!

Remember, a civil suit only requires a preponderance of the evidence, not proof beyond a reasonable doubt. That verified email might be enough to reach that standard.

In a criminal case it would not be enough...but if the matter was serious enough it might be enough to justify a warrant to search the email address owner's place and computer. At the very least that would be very annoying, and at the worst it could uncover things that the email holder does not want brought to law enforcement attention.

Re: “Username or password is incorrect” is bullshit

#129

Post by ocfx »

testvox wrote: post #121
stordoff wrote: post #110

Earlier quoted context omitted.

That's the point of the article though - for a large percentage of services, if you know the username/email address you are targeting, you can just try to register them and see if it works. Obfuscating the login process makes little difference.

Which is why they shouldn't leak this information on the registration page... Instead they should pretend the registration always succeeds and then disallow login until the email has been verified.

Which is back to bad UX.

Re: “Username or password is incorrect” is bullshit

#130

Post by exabrial »

My other favorite security theater advice is locking an account after x number of failures. How could this used for anything but DOS?

Depending on the service that's being protected, rate-limiting to 5 minutes between attempts, alerting the owner, and assigning them a temporary username seems more reasonable countermeasures to me.

Post reply on HN