Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Username or password is incorrect” is bullshit

hackernoon.com

Post reply on HN
Print view View original

141–150 of 170 posts

Re: “Username or password is incorrect” is bullshit

#141

Post by dboreham »

larzang wrote: post #65
IshKebab wrote: post #25

Earlier quoted context omitted.

Assume a user got their username or password wrong. What is more likely, they got their username wrong in a way that happens to be the same as another user, or they got their password wrong?

I have a commonish firstlast@gmail account and frequently receive what is the obvious result of people in various parts of the country incorrectly providing my email to apply for jobs, order pizzas, and use other services. It is absolutely common for users to supply the incorrect username/email.

This is why it is common practice to require the user to enter their email address twice in forms.

Re: “Username or password is incorrect” is bullshit

#142

Post by failrate »

pornel wrote: post #71

The right answer isn't a blanket "sites should do this super-secret e-mail-only shuffle and not tell you anything". First, you should define your threat model: which information is considered secret and which isn't, and treat any violations as security vulnerabilities. If usernames are public by design, then don't hide them in one form, and expose in URLs elsewhere on the site. If exposing who's registered on your si…

I take issue with your cookie site example, because the user of the cookie site is probably using the same credentials on an important, sensitive site.

Re: “Username or password is incorrect” is bullshit

#143

Post by alangpierce »

interfixus wrote: post #138
mnarayan01 wrote: post #117

Earlier quoted context omitted.

Doing it every time a user login failed is probably infeasible if you have even a moderate number of users, but you can presumably do it on an ad hoc basis unless you have a ton of users. Or am I missing something?

Yes you are. If you have done your security right, users' passwords are not stored in a form that lets you determine whether one is equal to another.

It's a little different from determining if one salted hashed password is the same as another salted hashed password. Whether it's account signup ("the password is already in use") or login ("you typed in someone else's password"), you have the plaintext of the password, and can just loop through the user table and attempt a login for every user with that password. It's slow when you have a lot of users, as mnarayan01 mentioned, but certainly reasonable as an ad-hoc thing.

(Not that any of this is good practice.)

Re: “Username or password is incorrect” is bullshit

#144

Post by interfixus »

alangpierce wrote: post #143
interfixus wrote: post #138

Earlier quoted context omitted.

Yes you are. If you have done your security right, users' passwords are not stored in a form that lets you determine whether one is equal to another.

It's a little different from determining if one salted hashed password is the same as another salted hashed password. Whether it's account signup ("the password is already in use") or login ("you typed in someone else's password"), you have the plaintext of the password, and can just loop through the user table and attempt a login for every user with that password. It's slow when you have a lot of users, as mnarayan0…

That's so horrible it never entered my mind. But you're right, of course, one could do that.

Re: “Username or password is incorrect” is bullshit

#145

Post by koolba »

sp332 wrote: post #122
pornel wrote: post #71

The right answer isn't a blanket "sites should do this super-secret e-mail-only shuffle and not tell you anything". First, you should define your threat model: which information is considered secret and which isn't, and treat any violations as security vulnerabilities. If usernames are public by design, then don't hide them in one form, and expose in URLs elsewhere on the site. If exposing who's registered on your si…

Right, for example if you run an email service, your usernames (addresses) should be hidden. That's because a spammer could use your login page to find valid usernames and then send spam to them. They don't have to guess passwords to cause damage.

They could also use your signup page to attempt to create an account for user@example.com. Since you can't allow duplicates that rejection gives them the same information.

Might as well let a user logging in that the username is incorrect to make the legit use case, i.e. user has a typo and/or misremembers their username, more pleasant.

I usually suggest clearing the username field on failed logins as well. That way if there is a typo, the user doesn't try it again thinking only the password is wrong.

Re: “Username or password is incorrect” is bullshit

#146

Post by Someone1234 »

sp332 wrote: post #122
pornel wrote: post #71

The right answer isn't a blanket "sites should do this super-secret e-mail-only shuffle and not tell you anything". First, you should define your threat model: which information is considered secret and which isn't, and treat any violations as security vulnerabilities. If usernames are public by design, then don't hide them in one form, and expose in URLs elsewhere on the site. If exposing who's registered on your si…

Right, for example if you run an email service, your usernames (addresses) should be hidden. That's because a spammer could use your login page to find valid usernames and then send spam to them. They don't have to guess passwords to cause damage.

Or just use the SMTP specification and or bounce-backs to do the same...

Re: “Username or password is incorrect” is bullshit

#147

Post by jwilk »

tantanel wrote: post #114
zimbatm wrote: post #53

Earlier quoted context omitted.

In the GitHub case the handles are public information. Anyone can go to " rel="nofollow">https://github.com/ to verify if it exists. So they trade off usability of a clear error message for no gain at all.

This is true for the username but it's possible to make your email address private on GitHub in which case the message that your email is taken can still be considered an information leak.

You can check if an e-mail is associated with a GitHub account easily. You forge a commit with this email as author email, push it to a foo/bar repo, then look at https://github.com/foo/bar/commits/master .

Re: “Username or password is incorrect” is bullshit

#148

Post by styfle »

I asked this same question[0] on StackExchange earlier this year. It has been asked many times and it really comes down to considering a username a secret or not.

In B2B applications where there is no registration form, then the username is probably a secret. In B2C applications where anyone can register, then the username likely isn't a secret. Many of those applications have the concept of "mentions" by username so clearly the username is not considered a secret in that case.

[0]: https://security.stackexchange.com/q/158075/11536

Re: “Username or password is incorrect” is bullshit

#149

Post by derimagia »

ecesena wrote: post #134
pornel wrote: post #71

The right answer isn't a blanket "sites should do this super-secret e-mail-only shuffle and not tell you anything". First, you should define your threat model: which information is considered secret and which isn't, and treat any violations as security vulnerabilities. If usernames are public by design, then don't hide them in one form, and expose in URLs elsewhere on the site. If exposing who's registered on your si…

I think there is an important point which is ignored, in the article and here in the thread: typos. Unfortunately, when designing a login flow (and a signup one), you can’t assume that the user always inputs the right things. Try logging in into facebook, for example, mistyping gmail or with your password with the wrong case, like all uppercase. In many cases... you get in! This is to prove that they had to “improve”…

A lot of places separate out the email/username field so it's a 2-step form. They will show you your avatar and maybe some other public info when you enter the password. This is a better way to do this I believe, although it does make logging in with a password manager [slightly] more annoying.

Re: “Username or password is incorrect” is bullshit

#150

Post by Amorymeltzer »

swsieber wrote: post #132
Amorymeltzer wrote: post #88

Earlier quoted context omitted.

Nah, user logins/emails often won't be long enough or random enough. See https://security.stackexchange.com/a/8024/28881 and https://stackoverflow.com/a/5565071/2521092

Would it be an okay practice to prepend the username as extra salt, still using the randomly generated salt?

Why not just use a longer salt? The username is only going to reduce randomness. Moreover, I don't buy the presumed advantage: nobody is really parsing that message to mean someone else could have the same password.
Post reply on HN