Also if you are doing the username/password is incorrect you should also add an artificial delay if it's the username is wrong. Because you can tell which one is wrong my seeing how long it takes the server to respond.
“Username or password is incorrect” is bullshit
151–160 of 170 posts
Re: “Username or password is incorrect” is bullshit
#152If you're just trying to find a set of accounts with a weak password, isn't it much more viable to use the sign-in page that shows "invalid password" instead of "invalid username or password" rather than dealing with captchas on the signup page? Assuming you can't just find usernames as public profiles like on GitHub.
Re: “Username or password is incorrect” is bullshit
#153Stripe does it wrong, so it's wrong everywhere? Nah. That's bullshit.
For emails, you can very easily fake a second signup with the same email and ping out an enhanced verification email "Somebody just tried to register with this address but you already have an account".
Building the username into that flow is harder. That's why I preference not having separate usernames but some people would argue this is itself a bad thing (removing a factor or somesuch).
Either which way, Stripe's approach is broken. That doesn't make the whole idea nonsense.
Re: “Username or password is incorrect” is bullshit
#154Earlier quoted context omitted.
I have a commonish firstlast@gmail account and frequently receive what is the obvious result of people in various parts of the country incorrectly providing my email to apply for jobs, order pizzas, and use other services. It is absolutely common for users to supply the incorrect username/email.
This is why it is common practice to require the user to enter their email address twice in forms.
Thank heavens we never invented copy and paste, would certainly make this more of an issue.
Re: “Username or password is incorrect” is bullshit
#155Earlier quoted context omitted.
Nah, user logins/emails often won't be long enough or random enough. See https://security.stackexchange.com/a/8024/28881 and https://stackoverflow.com/a/5565071/2521092
Would it be an okay practice to prepend the username as extra salt, still using the randomly generated salt?
Be careful about how you merge the username and the random salt.
Re: “Username or password is incorrect” is bullshit
#156Earlier quoted context omitted.
It also seems that would help with not giving out passwords to spoofing sites
The spoofing site could just pretend your U2F was valid and get your password, although it couldn't really do anything with it anyway.
The spoofing site wouldn't/shouldn't be able to pass the browser validation of the TLS server side certificate.
Re: “Username or password is incorrect” is bullshit
#157Earlier quoted context omitted.
This is why it is common practice to require the user to enter their email address twice in forms.
Thank heavens we never invented copy and paste, would certainly make this more of an issue.
Apparently the set of users who don't know how to type their own email and the set who know how to use copy/paste are non-overlapping.
Re: “Username or password is incorrect” is bullshit
#158Earlier quoted context omitted.
I think there is an important point which is ignored, in the article and here in the thread: typos. Unfortunately, when designing a login flow (and a signup one), you can’t assume that the user always inputs the right things. Try logging in into facebook, for example, mistyping gmail or with your password with the wrong case, like all uppercase. In many cases... you get in! This is to prove that they had to “improve”…
A lot of places separate out the email/username field so it's a 2-step form. They will show you your avatar and maybe some other public info when you enter the password. This is a better way to do this I believe, although it does make logging in with a password manager [slightly] more annoying.
This is often done to support SAML or other federated sign in
Re: “Username or password is incorrect” is bullshit
#159I have an argument for "username or password is incorrect" messages: it's possible that the password is correct, username exists but isn't the intended one. Then "password is incorrect" message would be lying, as the issue is actually with a username.
If that is the justification, then the possible error responses could be: 1. Username is incorrect, or 2: Username or password is incorrect. If no user exists with that username, then you can just tell the user that the username is incorrect.
Re: “Username or password is incorrect” is bullshit
#160Earlier quoted context omitted.
It knows if it doesn't exist though. This whole thing is about sites that say "Username or password is wrong" when they know the username is wrong because it doesn't exist!
The message is still not wrong if you think of "or" as the boolean or, not as the boolean xor. The system knows the username is wrong but it doesn't know anything about the password.
It's not wrong, it's just not as helpful as it could be.