Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid username or password” is a useless security measure

kev.inburke.com

Post reply on HN
Print view View original

131–140 of 188 posts

Re: “Invalid username or password” is a useless security measure

#131

Post by tracker1 »

Someone1234 wrote: post #112
tracker1 wrote: post #81

Earlier quoted context omitted.

I have to agree with the parent here... There are other ways to add security, and having an obscure error message doesn't really improve things by as much as the error message can cause real users to go down the wrong path.

Who are you "agreeing" with? Neither me nor the article is arguing for inexact error messages. We both agree that registration pages leaking that information make hiding if a username is correct a pointless exercise. On that point me and the article are in complete agreement.

I never stated a disagreement with you or the article... I specifically stated that I agree with you on the topic.

Re: “Invalid username or password” is a useless security measure

#132

Post by patal »

pbreit wrote: post #54
tacostakohashi wrote: post #3

Leaving security aside, "incorrect username/password" is still the more correct and useful statement. Consider the case where you mistype your username (email). For sites like amazon, gmail, hotmail, yahoo, twitter, etc, it is entirely likely that the mistyped username is somebody else's valid username, you typed the password correctly, and "incorrect password" would hide the problem.

"is still the more correct and useful statement" No, it is usually incorrect and it is much less helpful than identifying which is incorrect. "it is entirely likely that the mistyped username is somebody else's valid username" No, that's highly unlikely. If the email isn't in the DB, just say so. If the password doesn't match, just say so.

> No, it is usually incorrect...

If either the username does not exist, or the password does not match the existing username, then "incorrect username or password" is correct by logic. It might be incorrect if assuming xor meaning, because both could be wrong -- username and password.

The parent's point also was that the service can not identify which one is wrong. Was it the username if the password did not match but matches any other account?

> No, that's highly unlikely.

Why should it be unlikely to mistype the username? Misspellings happen. Some people check what they entered, some don't. People confuse their usernames when they have many. One username might be someone else's on another service. Etc.

> If the password doesn't match, just say so.

Which is wrong if the error lies with the username, not the password, and the mistyped username happens to exist.

Re: “Invalid username or password” is a useless security measure

#133

Post by why-el »

spion wrote: post #32
why-el wrote: post #13

None of the author's recommendations conflict with the practice he is advocating against. I think websites say "Bad combination" not because usernames are treated equally with passwords, but because you don't have a choice but say that. If I tell you that your username is incorrect, am I telling you your password isn't? This would be silly, because if the website is new and I know a password is correct, then I can ei…

"Sorry, we don't have a in our database" isn't misleading. If the user enters an incorrect password too, the subsequent message "Invalid password for " will let them correct it.

Perhaps misleading was the wrong word, but as you said it yourself, saying that would lead to a user experience that is much worse than a simple "Bad experience", which is exactly my point.

Re: “Invalid username or password” is a useless security measure

#134

Post by why-el »

Evolved wrote: post #129
why-el wrote: post #13

None of the author's recommendations conflict with the practice he is advocating against. I think websites say "Bad combination" not because usernames are treated equally with passwords, but because you don't have a choice but say that. If I tell you that your username is incorrect, am I telling you your password isn't? This would be silly, because if the website is new and I know a password is correct, then I can ei…

If I tell you that your username is incorrect, am I telling you your password isn't? This would be silly, because if the website is new and I know a password is correct, then I can either find the username out there (if the website is social), or pretend I forgot my username and have them give it to me. Not exactly. Multiple users could obviously have the same password but not the same username. Telling an attacker t…

I mentioned exactly those what I think "some way to narrow it down" is, mainly new websites with significantly less users, websites where its common to have your username known in public, and even websites that allow you to query their APIs for username data.

Re: “Invalid username or password” is a useless security measure

#135

Post by makmanalp »

andrewstuart2 wrote: post #51

I think the real lesson here is that if emails should remain secret you should not indicate upon signup whether or not a user exists with that email. Always send an email. If that user already exists, make sure the email says "We noticed you're trying to sign up again. If you didn't do this, someone else is trying to sign up for you." If that user doesn't exist, send them the typical signup message. The author has so…

This doesn't really work that well, I realize - when users mistype their e-mail, they get their registration sent to some random address, and they get zero feedback on what went wrong. From their perspective, the registration worked and they just got no e-mail. Bad experience.

Re: “Invalid username or password” is a useless security measure

#136

Post by MAGZine »

I don't agree with the author's premise wrt to usernames.

Often, you will login with a username, but the password recovery form will only accept an email. You might be able to correlate these two if you have a lot of data from other, external attacks, but unless if I noticed correlation between recovered passwords and account break-ins, I wouldn't worry about this.

There's a security tradeoff, but sometimes security must be risked in the name of functionality, or you'll have a lame product. Or, you can have both security and functionality, but to the detriment of UX.

Take leaderboards for example. If you have a leaderboard for your app/game, you'll expose user's username (and thus, sign-in name, as is often the case). You could mitigate this by: having a separate login name (ala steam), or using an email (which exposes people to the recovery exploit), but it doesn't make the UX any better.

In the end, I'd say trying to protect against username/email guessing attacks is probably unnecessary. There are better ways to approach security.

Re: “Invalid username or password” is a useless security measure

#137

Post by waxjar »

mbesto wrote: post #128
andrewstuart2 wrote: post #33

Earlier quoted context omitted.

> That's terrible UX. I think the goal when the User is a malicious attacker is for them to have a terrible UX.

Huh? He's suggesting that as a Real User that if you don't whether you have an account at all is to just sign up again. People use multiple emails for different accounts all of the time. How is that not a frustrating experience for the Real User?

That's not what is meant.

An attacker who wants to find out of if the person with "example@example.com" has on account on your website, could try signing up with "example@example.com". If they get an error message, they know the person has an account on the website.

Re: “Invalid username or password” is a useless security measure

#138

Post by drinchev »

I think this idea might blow a lot of A/B testing and conversion rates. People would have to check their e-mail address for actually creating their accounts, although e-mails are already obsolete for even activating the account ( You can just sign-up and sign-in later with your password you entered ).

May be behind this the author put some good deeds, but in the end I think it's overkill.

Re: “Invalid username or password” is a useless security measure

#139

Post by codazoda »

I was convinced until the main suggestion was to, "Consider throttling invalid login attempts by IP address or subnet."

The rest sounded okay but that seems to indicate that the author probably hasn't tried to solve the security problem on a busy site.

Re: “Invalid username or password” is a useless security measure

#140

Post by andrewstuart2 »

kevinburke wrote: post #88
andrewstuart2 wrote: post #51

I think the real lesson here is that if emails should remain secret you should not indicate upon signup whether or not a user exists with that email. Always send an email. If that user already exists, make sure the email says "We noticed you're trying to sign up again. If you didn't do this, someone else is trying to sign up for you." If that user doesn't exist, send them the typical signup message. The author has so…

Thanks for this. I updated the post to add this as a possibility. This adds more friction in the signup process than I'd be willing to accept, but it does solve the information disclosure problem.

Sweet. As long as I get my cut. :-P

I have a hard time seeing what friction is added, though, with proper thought. If you don't require email validation but use it as a unique login identifier, then a malicious body could DOS all future users via bulk signups. DDOS required if you use rate limiting on signups. Slightly different application of the attack but still a denial of service.

Even a non-hacker could block another user from signing up by simply creating an account with someone else's email address.

If you don't use it as a unique login identifier, there's no problem at all. New users use their username to login.

Post reply on HN