Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Username or password is incorrect” is bullshit

hackernoon.com

Post reply on HN
Print view View original

131–140 of 170 posts

Re: “Username or password is incorrect” is bullshit

#131

Post by steanne »

ballenf wrote: post #124
pornel wrote: post #71

The right answer isn't a blanket "sites should do this super-secret e-mail-only shuffle and not tell you anything". First, you should define your threat model: which information is considered secret and which isn't, and treat any violations as security vulnerabilities. If usernames are public by design, then don't hide them in one form, and expose in URLs elsewhere on the site. If exposing who's registered on your si…

The other right answer is do not let someone create an account with an email they don't have access to. My short gmail address gets a signup on some random website a couple times a month and they're often nigh unto impossible to delete. Fitbit is one of the worst for this.

oh yes, i get french people ordering cabs from paris.

Re: “Username or password is incorrect” is bullshit

#132

Post by swsieber »

Amorymeltzer wrote: post #88
nhumrich wrote: post #78

Earlier quoted context omitted.

Wow, using the user as the salt is awesome. Is this considered an ok security practice?

Nah, user logins/emails often won't be long enough or random enough. See https://security.stackexchange.com/a/8024/28881 and https://stackoverflow.com/a/5565071/2521092

Would it be an okay practice to prepend the username as extra salt, still using the randomly generated salt?

Re: “Username or password is incorrect” is bullshit

#133

Post by cjwhite »

StavrosK wrote: post #96
u801e wrote: post #63

Not quite on topic, but it would be nice if more websites would offer the option of using client side TLS certificate "login" with or without an additional prompt for a username and password. It would be next to impossible for an attacker to bypass that. For example, even if the attacker provided the correct credentials, they most likely would not have the associated client-side TLS certificate private key. Then the…

U2F does that. I wonder if sites could use the U2F token as the first factor and ask you to enter a password as the second factor (along with a "remember this computer" box for the password). Would make things much more convenient (unless you were on a device that didn't support U2F, I guess).

It also seems that would help with not giving out passwords to spoofing sites

Re: “Username or password is incorrect” is bullshit

#134

Post by ecesena »

pornel wrote: post #71

The right answer isn't a blanket "sites should do this super-secret e-mail-only shuffle and not tell you anything". First, you should define your threat model: which information is considered secret and which isn't, and treat any violations as security vulnerabilities. If usernames are public by design, then don't hide them in one form, and expose in URLs elsewhere on the site. If exposing who's registered on your si…

I think there is an important point which is ignored, in the article and here in the thread: typos.

Unfortunately, when designing a login flow (and a signup one), you can’t assume that the user always inputs the right things.

Try logging in into facebook, for example, mistyping gmail or with your password with the wrong case, like all uppercase. In many cases... you get in! This is to prove that they had to “improve” their flow to account for wrong user input.

Because user input can be wrong in both email or password, the error message should account for both.

Re: “Username or password is incorrect” is bullshit

#135

Post by dreamdu5t »

What’s the point of having passwords at all? If there’s a password reset mechanism they provide no additional security. Just send a one time login token to the email.

Having a password just increases the odds of a hack by the user accidentally exposing it.

Re: “Username or password is incorrect” is bullshit

#136

Post by icebraining »

tzs wrote: post #127
icebraining wrote: post #64

Earlier quoted context omitted.

You should definitively set the password after clicking the link. That said, what would an attacker do with that account?

Suppose it were a social media site. Now that attacker has a working account with someone else's email address, and that email address is considered verified by the site. The attacker could then use that account to post threats, harass people, and so on. If he goes far enough that either law enforcement wants to come after him or someone wants to sue him and the site is served with a warrant to reveal information abo…

And all of this activity on the site happens without the site ever sending a single other email besides the account verification, that would tip-off the victim?

Color me unconvinced.

Re: “Username or password is incorrect” is bullshit

#137

Post by chc »

GlitchMr wrote: post #40

I have an argument for "username or password is incorrect" messages: it's possible that the password is correct, username exists but isn't the intended one. Then "password is incorrect" message would be lying, as the issue is actually with a username.

I think you're confusing "correct" and "exists" or "was entered deliberately." A password can only be correct or not for a given account. If the password differs from the one recorded for the user you specified, it is incorrect. It doesn't matter if there's some other place where that password does exist.

A system that used an "existence" or "user intended to type this" concept of password correctness would be either unimplementable or insecure to the point of uselessness.

Re: “Username or password is incorrect” is bullshit

#138

Post by interfixus »

mnarayan01 wrote: post #117
gregoriol wrote: post #67

Earlier quoted context omitted.

If you, as a developer, are technically able to check that the password is used by another user, you have failed pretty big at best practices.

Doing it every time a user login failed is probably infeasible if you have even a moderate number of users, but you can presumably do it on an ad hoc basis unless you have a ton of users. Or am I missing something?

Yes you are. If you have done your security right, users' passwords are not stored in a form that lets you determine whether one is equal to another.

Re: “Username or password is incorrect” is bullshit

#139

Post by ad-hominem »

swsieber wrote: post #132
Amorymeltzer wrote: post #88

Earlier quoted context omitted.

Nah, user logins/emails often won't be long enough or random enough. See https://security.stackexchange.com/a/8024/28881 and https://stackoverflow.com/a/5565071/2521092

Would it be an okay practice to prepend the username as extra salt, still using the randomly generated salt?

No, the hashed passwords will be way too salty and will throw off the flavor of the app

Re: “Username or password is incorrect” is bullshit

#140

Post by StavrosK »

cjwhite wrote: post #133
StavrosK wrote: post #96

Earlier quoted context omitted.

U2F does that. I wonder if sites could use the U2F token as the first factor and ask you to enter a password as the second factor (along with a "remember this computer" box for the password). Would make things much more convenient (unless you were on a device that didn't support U2F, I guess).

It also seems that would help with not giving out passwords to spoofing sites

The spoofing site could just pretend your U2F was valid and get your password, although it couldn't really do anything with it anyway.
Post reply on HN