Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid username or password” is a useless security measure

kev.inburke.com

Post reply on HN
Print view View original

181–188 of 188 posts

Re: “Invalid username or password” is a useless security measure

#181

Post by wiredfool »

ernesth wrote: post #94
Someone1234 wrote: post #66

> Consider throttling invalid login attempts by IP address or subnet. Oh hell no. First off that is completely ineffective. Botnets are common and inexpensive. But worse still a lot of users often share a single IP (e.g. university dorms, businesses, public wifi, etc). I agree with the first part of this article (i.e. that it is trivial to "prove" a username is valid, and that worse error responses aren't accomplishi…

>> Exponential backoff (forcing attackers to try again after 1, 2, 4, 8, 16.. seconds) is useful as well. > Just open a spreadsheet and determine how long it would take to test 1500 passwords. 5.557 * 10^443 average Gregorian years.

Two thoughts:

* Concurrency -- I can check a lot of passwords at once. Are there race conditions in the backoff? Can I check 20 in one second? 200? What about all 1500? (yeah, that's not subtle and alarm bells should go off).

* Alternately, one can iterate usernames against common passwords, especially if usernames are known. (and as a subset of this, if accounts are locked after n tries and usernames are iterable, that's a DOS waiting to happen)

Re: “Invalid username or password” is a useless security measure

#182

Post by ajanuary »

Someone1234 wrote: post #66

> Consider throttling invalid login attempts by IP address or subnet. Oh hell no. First off that is completely ineffective. Botnets are common and inexpensive. But worse still a lot of users often share a single IP (e.g. university dorms, businesses, public wifi, etc). I agree with the first part of this article (i.e. that it is trivial to "prove" a username is valid, and that worse error responses aren't accomplishi…

> Just open a spreadsheet and determine how long it would take to test 1500 passwords. After about 58 attempts the sun would have exploded. After 1023 attempts my spreadsheet application can't cope with numbers that big.

Re: “Invalid username or password” is a useless security measure

#183

Post by deciplex »

dbpatterson wrote: post #174
ObligatoryRef wrote: post #168

Earlier quoted context omitted.

If they're stupid enough to allow non-unique usernames I wouldn't bet on getting a helpful answer like that :)

You do realize the helpful answer reveals another users username and password...

Anything other than allowing the user to register with the same username and password as someone else will already give it away, so I don't see the harm in spelling it out.

Re: “Invalid username or password” is a useless security measure

#184

Post by Sarkie »

andrewstuart2 wrote: post #51

I think the real lesson here is that if emails should remain secret you should not indicate upon signup whether or not a user exists with that email. Always send an email. If that user already exists, make sure the email says "We noticed you're trying to sign up again. If you didn't do this, someone else is trying to sign up for you." If that user doesn't exist, send them the typical signup message. The author has so…

Hotmail used to do this and still does, so easy to find if an email is real.

Email is found, password is not correct. Email unknown.

Re: “Invalid username or password” is a useless security measure

#185

Post by lazyant »

If I remember correctly, revealing if an email address is already in the system is considered information disclosure vulnerability in OWASP tests, presumably because then you can do spear phishing against that email using the information that is subscribed to the service.

Re: “Invalid username or password” is a useless security measure

#187

Post by Domenic_S »

tacostakohashi wrote: post #3

Leaving security aside, "incorrect username/password" is still the more correct and useful statement. Consider the case where you mistype your username (email). For sites like amazon, gmail, hotmail, yahoo, twitter, etc, it is entirely likely that the mistyped username is somebody else's valid username, you typed the password correctly, and "incorrect password" would hide the problem.

I actually have two amazon accounts with the same email address (username), one has prime and the other one doesn't. Sometimes I type in the 'other' password and get the non-prime account and get confused.

Re: “Invalid username or password” is a useless security measure

#188

Post by jules »

scragg wrote: post #150
jules wrote: post #147

Earlier quoted context omitted.

It's not the same, since his message indicates that the username does exist whereas your message does it.

"username or password incorrect" does not imply that the username was correct or incorrect. The system is saying one or both fields are incorrect.

Read the proposed message a few comments up. It actually says "username & password do not match the records we have for username XXX", thus implying that username XXX is a valid username. "Username or password is incorrect" does not indicate whether the username is valid or not.
Post reply on HN