Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Username or password is incorrect” is bullshit

hackernoon.com

Post reply on HN
Print view View original

161–170 of 170 posts

Re: “Username or password is incorrect” is bullshit

#161

Post by wyuenho »

croon wrote: post #49
wyuenho wrote: post #35

Earlier quoted context omitted.

Except that when you are signing up, unless the service is using some draconian password formatting rules, any "email or password is incorrect" error can be inferred as the email is incorrect, and if the email format is correct, it's must likely because the email was taken. "email or password is incorrect" is bullshit is right.

Either you or I misunderstood GP. I understood it as if (as long as any email format validation allows the address) the service only outputs "sent you an email for confirmation", even if the email is registered. The attacker wouldn't know if it was the first time or the 50th time that message had been shown, as it's always the same.

I understand him perfectly, what I'm saying is what he's proposing is useless, because you can mold your email and password into anything that you know for certain it will pass validation, that's your oracle right there. During sign up, if you know both the formatting rules of what you typed as the email and the password cannot have caused an error, then it follows any error message (500 errors notwithstanding) must be a duplicate email. Because that's typically the only constraint difference exists between an email and a password.

Given that, who cares what error message you display, as an attacker I only need to be able to find out weather a system has an email or not, and the sign up screen is a perfect oracle.

Re: “Username or password is incorrect” is bullshit

#163

Post by gozur88 »

testvox wrote: post #121
stordoff wrote: post #110

Earlier quoted context omitted.

That's the point of the article though - for a large percentage of services, if you know the username/email address you are targeting, you can just try to register them and see if it works. Obfuscating the login process makes little difference.

Which is why they shouldn't leak this information on the registration page... Instead they should pretend the registration always succeeds and then disallow login until the email has been verified.

That works for the email, but not the user name. Going through the entire process and then telling the new user "That one's already taken, please start over" is not going to make people happy.

Re: “Username or password is incorrect” is bullshit

#164

Post by mark-r »

alangpierce wrote: post #143
interfixus wrote: post #138

Earlier quoted context omitted.

Yes you are. If you have done your security right, users' passwords are not stored in a form that lets you determine whether one is equal to another.

It's a little different from determining if one salted hashed password is the same as another salted hashed password. Whether it's account signup ("the password is already in use") or login ("you typed in someone else's password"), you have the plaintext of the password, and can just loop through the user table and attempt a login for every user with that password. It's slow when you have a lot of users, as mnarayan0…

You might be able to do it for all user names within a certain Levenshtein distance of the current user. That would handle mistyping, but it wouldn't handle the case where you have numerous emails and forgot which you signed up with on this site.

Re: “Username or password is incorrect” is bullshit

#165

Post by StavrosK »

u801e wrote: post #156
StavrosK wrote: post #140

Earlier quoted context omitted.

The spoofing site could just pretend your U2F was valid and get your password, although it couldn't really do anything with it anyway.

The spoofing site wouldn't/shouldn't be able to pass the browser validation of the TLS server side certificate.

Why not? How hard is it to get a cert for a domain that looks like paypal-businesscenter.com?

Re: “Username or password is incorrect” is bullshit

#167

Post by stordoff »

j_s wrote: post #66

Ask HN: Why does Amazon allow multiple accounts with the same email address? (2014) | https://news.ycombinator.com/item?id=7075372

I've somehow ended up with three Amazon accounts under the same email address. Two on Amazon UK (which appear to be shared with Amazon US and Amazon DE), and then a third on Amazon JP (which only appears to work there). Very confusing at times (I've ended up putting a deliberate misspelling in my name -- Stpehen instead of Stephen -- so I can tell at a glance which account I'm on).

Re: “Username or password is incorrect” is bullshit

#168

Post by stordoff »

dreamdu5t wrote: post #135

What’s the point of having passwords at all? If there’s a password reset mechanism they provide no additional security. Just send a one time login token to the email. Having a password just increases the odds of a hack by the user accidentally exposing it.

At the expense of convenience - I often need to access accounts on devices where I don't have access to my emails (e.g. if I'm using a semi-trusted PC [family devices etc.], I might login to Amazon, because anything there can be undone, but I wouldn't login to an email account [and if I haven't memorised my email password because it's in a password manager, I might not even be able to]).

Re: “Username or password is incorrect” is bullshit

#169

Post by cjwhite »

StavrosK wrote: post #165
u801e wrote: post #156

Earlier quoted context omitted.

The spoofing site wouldn't/shouldn't be able to pass the browser validation of the TLS server side certificate.

Why not? How hard is it to get a cert for a domain that looks like paypal-businesscenter.com?

Moreover, the browser could remember the expected shared secret based on its and the server's RSA exchange.

Re: “Username or password is incorrect” is bullshit

#170

Post by gregoriol »

alangpierce wrote: post #143
interfixus wrote: post #138

Earlier quoted context omitted.

Yes you are. If you have done your security right, users' passwords are not stored in a form that lets you determine whether one is equal to another.

It's a little different from determining if one salted hashed password is the same as another salted hashed password. Whether it's account signup ("the password is already in use") or login ("you typed in someone else's password"), you have the plaintext of the password, and can just loop through the user table and attempt a login for every user with that password. It's slow when you have a lot of users, as mnarayan0…

If you are able to do that, then I insist: you probably have failed at best practices.

Most likely on this part: a good password hashing (ie. security hashing) should be fast so that you can log-in but slow enough to prevent brute force (ie. what you are implying). Hashings like md5/shaX don't have that: you can compute of lot them very quickly, which is their purpose. Bcrypt/Argon2/... will have a cost/time that will allow only a few computation per second, which is their purpose.

So if you did best practices well, and try to loop through your users database, (I assume you have more than a few hundreds users) it might take some time, some long time. Anyway, you'll then fail at another best practice because the initial user trying to log in will get bored and be gone somewhere else ;-)

Post reply on HN