Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid Username or Password”: a useless security measure (2014)

kevin.burke.dev

Post reply on HN
Print view View original

201–210 of 289 posts

Re: “Invalid Username or Password”: a useless security measure (2014)

#201

Post by Alupis »

MichaelCollins wrote: post #185
blacksmith_tb wrote: post #179

Earlier quoted context omitted.

I'd say that depends on what 'a conversion' is - if it's buying physical things (and getting shipping confirmations for them), an email is maybe not absolutely required, but most of your customers would probably still rather they got those?

Maybe they want SMS updates to their shipping, does that mean you should ask for confirmed phone numbers on signup? Of course not. Let them enter their email or phone number for shipping updates when they're confirming their purchase. Ideally you shouldn't require users to make an account to make a purchase at all. There should be a "guest" path for purchases. Some sites still get this right. I can buy anything from…

These are not good examples of everyday websites.

Southwest Airlines knows an awful lot more information about you than you provide them. They don't need your email address because they know who you are - and they make it your responsibility to monitor changes to your schedule/flight.

Dominos Pizza allows you to monitor in real time the status of your delivery on their website after checkout. You can provide an email address to access the tracking status page again if you close it.

Hacker News is not a good representation of anything outside of a very tech-focused forum. It's designed to be anonymous, there is nothing to keep track of (order status etc) and if you lose your password to HN, you might just be SOL. That's not going to fly for the general public.

Reddit is focused on eyeballs and clicks - nothing else. You're not buying things on Reddit and waiting for them to deliver to your house or whatever. Reddit just needs you to click and look at things to make money. Reddit also requires an email address, but if you don't provide a real one then you're SOL if you lose access. Again, not going to fly for the general public.

The reality is, most regular sites do need a reliable way to contact you for business reasons. Some are even required to have your contact information (for international shipments, as one example).

Your email inbox does a good job of holding emails for you, so let's stop pretending it's a huge burden to get an email... and if you find your way onto some newsletter list just click the unsubscribe button. It's not that hard...

Re: “Invalid Username or Password”: a useless security measure (2014)

#202

Post by Guest9081239812 »

thefreeman wrote: post #123
darrinmn wrote: post #117

Earlier quoted context omitted.

What do you mean login? I'm talking about the signup flow. The signin flow would be consistent with what is discussed in the article "invalid username or pw".

What do users usually do after registering an account? They try to login with it (assuming they aren't automatically logged in after registration which is what I would generally prefer / expect as a user). You are giving the user so many chances to just say "forget this" and move on to a different website. Especially if they are on mobile, registering for services is a huge pain in the butt. My basic point is you are…

On my site it works this way...

1. Choose desired plan.

2. Enter username, password, checkbox for terms of service.

3. Get prompted to enter the 6 digit confirmation code that was emailed to you (if you were already registered, it says you have an account and links to the login and password reset pages if required).

4. Registration is complete and the user is automatically signed in.

The username or email address isn't blocked until someone completes a registration with it.

Re: “Invalid Username or Password”: a useless security measure (2014)

#203

Post by MichaelCollins »

gauravphoenix wrote: post #200
MichaelCollins wrote: post #160

Earlier quoted context omitted.

If reducing friction is the priority, then maybe skip email completely. Let people sign up with any username and don't require an email at all, like HN allows. Most sites that require an email don't need an email, and only ask for it so they can spam users with nonsense like product updates.

>spam users with nonsense like product updates IMHO, not all product updates are nonsense.

[x] - Send me emails about product updates.

(Receiving these emails should be opt-in. But companies often find lame excuses to ignore this preference so I prefer to not hand over my email address at all.)

Re: “Invalid Username or Password”: a useless security measure (2014)

#204

Post by Beldin »

darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

True. Moreover, even if a site implemented this in a naive way, they made the UX much worse for the attacker. And that constitutes a significant issue, if we follow the reasoning of the article.

It does, actually: it hampers casual attackers -- those looking for any account in. On the other hand, attackers out to break into a specific account will not be deterred. Then again: they are not deterred in either case, so you might as well go with the version that impacts some attackers.

Re: “Invalid Username or Password”: a useless security measure (2014)

#205

Post by mod »

Sohcahtoa82 wrote: post #199
mod wrote: post #196

Earlier quoted context omitted.

Yes, it's my VPN triggering it. I run my own Wireguard on a DigitalOcean box, and I'm the only user--so not exactly a lot of bad traffic coming off of my IP (may have in the past, though). With the prevalence of Cloudfare now, it's pretty onerous to captcha every visit to a new site just because VPN. You would think Cloudfare could at least give me a "session" that persisted across the web, if they're going gatekeep…

> I run my own Wireguard on a DigitalOcean box, and I'm the only user May I ask why you bother doing this? At best, unless Wireguard is also filtering your traffic, the only privacy you're getting is hiding your home IP address. Trackers will still track you by IP and build a profile based on it. > You would think Cloudfare could at least give me a "session" that persisted across the web, if they're going gatekeep th…

I'm just tunneling, really. I prefer the logs on my WG box vs the local ISP and whoever else in-between. I don't think my webhost is really in the business of tracking down VPN users and selling out their browsing history, although it's possible. I do think my ISP probably is cashing in on people's browsing history, though, in some form or fashion.

I use a pi-hole as well to block the trackers etc as much as possible, and so I don't leak DNS requests to the ISP either.

Re: “Invalid Username or Password”: a useless security measure (2014)

#206

Post by ohbtvz »

pmontra wrote: post #75
Xylakant wrote: post #18

Earlier quoted context omitted.

Many services let you sign up with an existing email and just send a “you tried to sign up, but you seem to have an address already.” to the account owner. In that case it’s indistinguishable for the attacker. Many services already require email confirmation to finalize the signup process so the extra effort is low.

Those sites probably prompt the attacker with a "We have sent you an email with an activation link" and the owner receives the "you tried to sign up, but you seem to have an address already" message. In this way they don't leak anything to the attacker. By the way, I've been stuck for years with an ecommerce site that thinks I already registered with them using my email. They're telling me that I must activate the ac…

I'm confused, you've been trying to buy an item from that website for years and it never occurred to you to just use a different email address? This isn't really believable.

Re: “Invalid Username or Password”: a useless security measure (2014)

#207

Post by MichaelCollins »

Alupis wrote: post #201
MichaelCollins wrote: post #185

Earlier quoted context omitted.

Maybe they want SMS updates to their shipping, does that mean you should ask for confirmed phone numbers on signup? Of course not. Let them enter their email or phone number for shipping updates when they're confirming their purchase. Ideally you shouldn't require users to make an account to make a purchase at all. There should be a "guest" path for purchases. Some sites still get this right. I can buy anything from…

These are not good examples of everyday websites. Southwest Airlines knows an awful lot more information about you than you provide them. They don't need your email address because they know who you are - and they make it your responsibility to monitor changes to your schedule/flight. Dominos Pizza allows you to monitor in real time the status of your delivery on their website after checkout. You can provide an email…

> The reality is, most regular sites do need a reliable way to contact you for business reasons.

In these cases, which I think are more unusual than usual, a email can be required during checkout. There's almost never a valid reason to require a confirmed email account during account creation, before the user has even decided if they want to make a purchase.

Re: “Invalid Username or Password”: a useless security measure (2014)

#208

Post by dwheeler »

darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

Exactly, if you reveal that an account exists when you just type in an email address, then you have a privacy failure and probably a security failure.

For example, the OpenSSF's secure software development fundamentals course https://openssf.org/training/courses/> in its section on minimizing feedback https://github.com/ossf/secure-sw-dev-fundamentals/blob/main...> says:

* If a user tries to create an account using an email address, don't tell the user if an account with that email address already exists. Similarly, if a user tries to do a password reset using an email address, don't tell the user if there is no account with that email address. Providing that information would allow an attacker to determine if a specific email address is being used (or not) by some existing account.

Now for the unpopular take: not everyone lives in the US. The GDPR requires protection of personally-identifying information, and in many cases that includes email addresses that identify individuals. There are exceptions, but it's typically better to keep email addresses private unless the user specifically authorizes it.

Re: “Invalid Username or Password”: a useless security measure (2014)

#209

Post by ohbtvz »

allknowingfrog wrote: post #50
dubbel wrote: post #9

This is assuming that the service allows new users to sign up themselves. Also, testing it via signup sends a lot of emails to the victim (if the attacker tries a number of services), so the victim at least knows that something is up.

That was my first thought as well. The application that I maintain is invitation-only, so I think the rest of the argument is irrelevant to me.

I'm not sure what this brings to the conversation. I don't develop any web application, so the rest of the argument is also irrelevant for me. Should I broadcast that everywhere?
Post reply on HN