Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid Username or Password”: a useless security measure (2014)

kevin.burke.dev

Post reply on HN
Print view View original

131–140 of 289 posts

Re: “Invalid Username or Password”: a useless security measure (2014)

#131

Post by gondo »

thefreeman wrote: post #123
darrinmn wrote: post #117

Earlier quoted context omitted.

What do you mean login? I'm talking about the signup flow. The signin flow would be consistent with what is discussed in the article "invalid username or pw".

What do users usually do after registering an account? They try to login with it (assuming they aren't automatically logged in after registration which is what I would generally prefer / expect as a user). You are giving the user so many chances to just say "forget this" and move on to a different website. Especially if they are on mobile, registering for services is a huge pain in the butt. My basic point is you are…

The user should be automatically logged in after successful registration if the flow is implemented correctly.

Re: “Invalid Username or Password”: a useless security measure (2014)

#132

Post by thefreeman »

gchamonlive wrote: post #126
thefreeman wrote: post #123

Earlier quoted context omitted.

What do users usually do after registering an account? They try to login with it (assuming they aren't automatically logged in after registration which is what I would generally prefer / expect as a user). You are giving the user so many chances to just say "forget this" and move on to a different website. Especially if they are on mobile, registering for services is a huge pain in the butt. My basic point is you are…

The flow is 1. Sign up for an account 2. Enter the email 3. Receive a confirmation email 4. Create password 5. Sign in This is what op means. You just ingest step 2 without confirming the email is used or not. The actual account creation should occur only after email confirmation.

Gotcha. That does make more sense and basically signup and reset password are essentially the same process. If the user doesn't have an account previously at that point you collect the information needed to proceed. I personally would not want to break up my onboarding experience like this but I can see other people making the trade off.

Re: “Invalid Username or Password”: a useless security measure (2014)

#134

Post by herendin2 »

arm wrote: post #40
herendin2 wrote: post #33

Earlier quoted context omitted.

You can provide a more helpful error message by explicitly informing the user that the username they typed exists but they haven't offered the correct password for it. Unless the site searches to find out which username the entered password actually corresponds to (which is a whole new, terribly dangerous, can of worms), it can't do better than that Because any malicious player can easily check whether usernames exis…

> You can provide a more helpful error message by explicitly informing the user that the username they typed exists but they haven't offered the correct password for it. The parent poster already addressed that though: “ If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct. ” If you…

>The parent poster already addressed that

Thank you for your comment, but I don't agree

"telling the user that the username they typed exists, but they haven't offered the correct password for it" - is extremely different from Just telling the user 'wrong password'. It's different because it provides more information

>If you inform the user the username they typed exists, the chance of them not thinking about double-checking they didn’t mistype their own username increases.

That seems to be a user problem first of all, because it's based on the user's mistaken belief about the uniqueness of usernames. If possible, it would be best to help the user understand this.

Re: “Invalid Username or Password”: a useless security measure (2014)

#135

Post by thomastjeffery »

Just reading the title, I expected OP to be talking about invalid passwords, i.e. when a password's text can't be used because it's too short/long or has/doesn't have specific characters. That's a discussion I would be much more interested in; mostly because I'm sick of seeing long passwords be completely broken.

A better title for their post would be "incorrect", not "invalid".

Re: “Invalid Username or Password”: a useless security measure (2014)

#136

Post by bombcar »

gohohn wrote: post #118
godshatter wrote: post #114

Earlier quoted context omitted.

Most of those are trying to track me around the net for their own purposes. I'm not volunteering any extra information for them to profile me with. No thanks.

The only extra information you would be volunteering is that you signed in to a specific website. In most cases, this is not really a big deal.

You are also trusting the Oauth provider to never login as you for their own inscrutable purposes.

Re: “Invalid Username or Password”: a useless security measure (2014)

#137

Post by darrinmn »

layer8 wrote: post #120
thomastjeffery wrote: post #99

Earlier quoted context omitted.

You shouldn't be doing long web forms before creating an account anyway.

This is commonly the case for online shopping, where account creation is optional and may only occur after confirmation, but the order will be placed regardless.

See my comment https://news.ycombinator.com/item?id=33720405

Re: “Invalid Username or Password”: a useless security measure (2014)

#138

Post by bombcar »

joosters wrote: post #5

But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct. The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.

I remember some system on the coding horrors site or similar that would tell you “password already used” if anyone had it.

That could allow “bad username” if you got the password right!

Re: “Invalid Username or Password”: a useless security measure (2014)

#139

Post by dfxm12 »

So what we've done by promoting "Invalid username or password" is made our login form UX much, much worse, without increasing the security of our product.

Much, much worse? Not at all. It doesn't matter if you've forgotten your user name, email address or password; if you've forgotten your credentials, you reset your password, not keep guessing until you give up. The password reset will also clue you in as to if you've got the right email address.

Re: “Invalid Username or Password”: a useless security measure (2014)

#140

Post by thomastjeffery »

layer8 wrote: post #120
thomastjeffery wrote: post #99

Earlier quoted context omitted.

You shouldn't be doing long web forms before creating an account anyway.

This is commonly the case for online shopping, where account creation is optional and may only occur after confirmation, but the order will be placed regardless.

But in that case, there is still an account (just without login ability), and you are probably even sending an email.

So in the email you can include a link to optional account (username/password) creation.

And if you aren't sending an email, then the user has clearly decided not to create an account.

Post reply on HN