Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid username or password” is a useless security measure

kev.inburke.com

Post reply on HN
Print view View original

151–160 of 188 posts

Re: “Invalid username or password” is a useless security measure

#151

Post by mike-cardwell »

snowwolf wrote: post #124
andrewstuart2 wrote: post #51

I think the real lesson here is that if emails should remain secret you should not indicate upon signup whether or not a user exists with that email. Always send an email. If that user already exists, make sure the email says "We noticed you're trying to sign up again. If you didn't do this, someone else is trying to sign up for you." If that user doesn't exist, send them the typical signup message. The author has so…

Please don't always send an email. A malicious person can now start signing up every day with a bunch of emails resulting in users who do have an account receiving an email from your site daily/hourly saying "we noticed you're trying to sign up again". At which point they become annoyed with your service and either unsubscribe or delete their account. Hotmail do this everytime someone tries to reset my password which…

Re your Hotmail problem, personally I would spend 30 seconds configuring sieve to filter those annoying emails into my Trash so I never have to see them again. Problem solved.

Re: “Invalid username or password” is a useless security measure

#152

Post by mike-cardwell »

spb wrote: post #92
Someone1234 wrote: post #66

> Consider throttling invalid login attempts by IP address or subnet. Oh hell no. First off that is completely ineffective. Botnets are common and inexpensive. But worse still a lot of users often share a single IP (e.g. university dorms, businesses, public wifi, etc). I agree with the first part of this article (i.e. that it is trivial to "prove" a username is valid, and that worse error responses aren't accomplishi…

> Set no maximum password length (250+ characters) It's important to note that if you take the classical advice to "use bcrypt" ( http://codahale.com/how-to-safely-store-a-password/ ), your password will be effectively truncated at 72 characters.

Is there a similar affect for scrypt?

Re: “Invalid username or password” is a useless security measure

#153

Post by paublyrne »

tonyarkles wrote: post #76
paublyrne wrote: post #42

Earlier quoted context omitted.

More likely, people won't forget how to spell their email address, or make a mistake in typing it that isn't immediately obvious; they might not remember which of their emails they used to sign up, though, even if they only have a couple. No one else can sign up with an email address that belongs to you.

You'd be surprised... After removing the "type it twice" box during registration, the bounce rate of "welcome" emails went up quite a bit.

That's interesting. I always felt that repeating that field was a sort of faux validation, but maybe not!

Well, a lot of people do not know their own phone number.

Re: “Invalid username or password” is a useless security measure

#154

Post by runeks »

kevinburke wrote: post #88
andrewstuart2 wrote: post #51

I think the real lesson here is that if emails should remain secret you should not indicate upon signup whether or not a user exists with that email. Always send an email. If that user already exists, make sure the email says "We noticed you're trying to sign up again. If you didn't do this, someone else is trying to sign up for you." If that user doesn't exist, send them the typical signup message. The author has so…

Thanks for this. I updated the post to add this as a possibility. This adds more friction in the signup process than I'd be willing to accept, but it does solve the information disclosure problem.

I think it makes the signup process fairly simple and easy. At least, it doesn't complicate it. Email confirmations are almost standard anyway. The only difference is that by doing it this way, you don't reveal whether a user already exists with the email in question (the email is the username).

Re: “Invalid username or password” is a useless security measure

#155

Post by largote »

What sites should really say, is what dumb "password restrictions" they forced you to use on signup. For example sites should have a message that says:

"We are dumb enough to force your password to have at least one Uppercase/Lowercase/Number/Symbol and it must be at least 8 characters long, but you can't have consecutive numbers, this may make it different from your usual password pattern and force you to recover the password every goddam time you try to use our site".

Re: “Invalid username or password” is a useless security measure

#156

Post by Houshalter »

Coding_Cat wrote: post #111
Houshalter wrote: post #11

Earlier quoted context omitted.

Well you can at least inform the user that the username is incorrect if there is no user by that name.

You would still have the issues described in the OP. If it says "username incorrect" only when that user does not exist, you can still figure out a username by just trying them with a random password. If you get told "password incorrect" you know the username you just tried already exists.

Why is that an issue? You can also do that by trying to create accounts.

Re: “Invalid username or password” is a useless security measure

#157

Post by smt88 »

MiddleEndian wrote: post #130
smt88 wrote: post #113

Earlier quoted context omitted.

Many people are paranoid about connecting Google/Facebook to anything. You will lose users if you don't give them a plain username/password option.

I know, but it's so much easier. It's not like I can't look up someones email account manually without federated login, plus then I no longer have to store passwords. Of course, aside from my own projects, the only service I've seen that exclusively does this is Fancy Hands.

I agree that it's easier, and if you're only getting a unique identifier from that service (as well as a token), then it's really not unsafe. For the purposes of login, data sharing is unidirectional.

The problem is that Facebook totally mismanaged their apps when they first launched, and a lot of people were permanently turned off to "Connect to Facebook" functionality by random apps posting under the user's name.

My account was recently abused by Glassdoor, which fervently promised not to post anything to my friends, and then immediately did so.

Re: “Invalid username or password” is a useless security measure

#158

Post by shdon »

paublyrne wrote: post #153
tonyarkles wrote: post #76

Earlier quoted context omitted.

You'd be surprised... After removing the "type it twice" box during registration, the bounce rate of "welcome" emails went up quite a bit.

That's interesting. I always felt that repeating that field was a sort of faux validation, but maybe not! Well, a lot of people do not know their own phone number.

I've seen mistype rates of close to 20% without the second field. Still, my boss won't allow me to put in the second field because he feels it would hurt the user experience.

Re: “Invalid username or password” is a useless security measure

#159

Post by superuser2 »

andrewstuart2 wrote: post #51

I think the real lesson here is that if emails should remain secret you should not indicate upon signup whether or not a user exists with that email. Always send an email. If that user already exists, make sure the email says "We noticed you're trying to sign up again. If you didn't do this, someone else is trying to sign up for you." If that user doesn't exist, send them the typical signup message. The author has so…

> if emails should remain secret

This is important. It is not always necessary or appropriate to try to maintain the secrecy of otherwise public, directory information (like email addresses). Unless you are, say, FetLife, it doesn't actually make that much sense to hide the fact that joe@example.com has at one point signed up for your service.

On the other hand, associating joe@example.com with posts he thought were anonymous is an enormous violation.

Re: “Invalid username or password” is a useless security measure

#160

Post by Dylan16807 »

thisGuysAccount wrote: post #24
Dylan16807 wrote: post #15

Earlier quoted context omitted.

> This doesn't address timing attacks, which are why this is done in the first place. I don't follow. Surely the reason to hide usernames is not to prevent a timing attack that would reveal... usernames.

I might be missing what you're not following, but here's a quick explanation (and a reason why it's not a concern) Correct username, correct password: takes 30ms to execute the code Correct username, incorrect password: takes 15 ms to execute the code Incorrect username: Takes 7 ms to execute the code. You fuzz usernames, you get one that takes 15 ms, you know that's a valid username. You then start working the passw…

I understand how the timing attack works. I don't understand how it's a justification for hiding usernames. "You need to try to hide A because if you're not careful they can find A."

If anything the timing attacks weaken the argument against hiding usernames.

Post reply on HN