Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid Username or Password”: a useless security measure (2014)

kevin.burke.dev

Post reply on HN
Print view View original

231–240 of 289 posts

Re: “Invalid Username or Password”: a useless security measure (2014)

#231

Post by Dylan16807 »

prmph wrote: post #94
dheera wrote: post #72

Earlier quoted context omitted.

> there is no way the website can detect that situation Why? The website can salt, hash, match your password against all the hashed passwords for all the closest usernames within a certain edit distance. Not saying this is a good idea security-wise, but it's not impossible.

Apart from the security issues you've yourself noted, it's possible that the entered password matches another account's password coincidentally, not because the user intended to log in to that account.

If your account has the same password as another account that's 1 or 2 letters different, it's not really the site's job to protect you. You screwed up.

This is not a very big problem security-wise. It makes online attacks slightly easier, but you can limit online attempts pretty easily. It doesn't affect offline attempts at all.

The downvotes dheera got are extra inappropriate because they were just saying it's doable.

Re: “Invalid Username or Password”: a useless security measure (2014)

#232

Post by upofadown »

Usability always seems to lose to security. Then we complain that the users can't use the system.

I have come to think that every decision of this sort should first be an attempt to increase usability. Security is ultimately about usability. They are not actually at odds. Too often there is no analysis done after a potential security issue is identified past directly resolving the issue. Rarely will there be an attempt to reevaluate the usability after the change.

Re: “Invalid Username or Password”: a useless security measure (2014)

#233

Post by Dylan16807 »

michaelt wrote: post #88
duxup wrote: post #76

Earlier quoted context omitted.

Do most people who are throwing usernames and passwords at websites ... do that?

If they could benefit from the 'information leakage' of knowing a username exists, they would do. If they don't - then maybe this 'information leakage' worry is obsolete security advice. There's loads of obsolete security advice around. (of course there might be other, non-account-security-related reasons to make it impossible to know if an account exists. It's one thing if HN's login form reveals that user duxup exi…

There's another option, where trying to sign up takes more effort than trying to log in and leaves bigger red flags, so they won't use that method.

Re: “Invalid Username or Password”: a useless security measure (2014)

#234

Post by tromp »

kahrl wrote: post #197
tromp wrote: post #36

I'd prefer the error to be "invalid username" if the typed username is not registered, and "wrong username or password" if it is. The system only knows if the username is valid or not; it doesn't know whether it's wrong (i.e. mistyped).

I'd prefer to not create brute force vulnerability that leaks the site's list of user email addresses to an attacker.

As the article points out, this leaks it no more than trying to register an email address.

Re: “Invalid Username or Password”: a useless security measure (2014)

#235

Post by fabiospampinato »

marcosdumay wrote: post #169
MichaelCollins wrote: post #160

Earlier quoted context omitted.

If reducing friction is the priority, then maybe skip email completely. Let people sign up with any username and don't require an email at all, like HN allows. Most sites that require an email don't need an email, and only ask for it so they can spam users with nonsense like product updates.

Any site that requires a password will need an email for password resets.

Not true for end to end encrypted stuff, the server can't reset anything.

Re: “Invalid Username or Password”: a useless security measure (2014)

#236

Post by chongli »

Alupis wrote: post #201
MichaelCollins wrote: post #185

Earlier quoted context omitted.

Maybe they want SMS updates to their shipping, does that mean you should ask for confirmed phone numbers on signup? Of course not. Let them enter their email or phone number for shipping updates when they're confirming their purchase. Ideally you shouldn't require users to make an account to make a purchase at all. There should be a "guest" path for purchases. Some sites still get this right. I can buy anything from…

These are not good examples of everyday websites. Southwest Airlines knows an awful lot more information about you than you provide them. They don't need your email address because they know who you are - and they make it your responsibility to monitor changes to your schedule/flight. Dominos Pizza allows you to monitor in real time the status of your delivery on their website after checkout. You can provide an email…

Dominos Pizza allows you to monitor in real time the status of your delivery on their website after checkout

Dominos doesn't even verify that you own an email address when you register one. I have received Dominos delivery updates sent to my email address for pizzas delivered to a person who doesn't even live in the same country as me. These updates contained a bunch of PII information about the customer including their exact home address depicted on a map inside the email.

Web developers: verify that people own the email addresses or phone numbers that they register!

Re: “Invalid Username or Password”: a useless security measure (2014)

#237

Post by pixl97 »

justsomehnguy wrote: post #19

> Check submitted passwords against a dictionary of common passwords (123456, monkey, etc) and ban that traffic extra hard. > Give guidance to users about creating strong passwords Yeah, if I just want to talk about a propane with some folks I would eagerly wait to be lectured about IT security, scolded at my passwords of choice, go out of my way to appease site administrator's password policy...

The internet you want no longer exists.

Stealing your account talking about propane sounds like a great way for me to inject spam/propaganda right in the middle of a group of trusted individuals. And this is exactly what we see countless times. Accounts with bad passwords get compromised, spam, then banned.

You're using a shared resource, you need to use it responsibly.

Re: “Invalid Username or Password”: a useless security measure (2014)

#238

Post by AtNightWeCode »

Would not go as far as saying 99.9% does this. A third-party pentest company we use does not consider this a security issue. I am not sure. I think it is information leak. I think the idea is that at some scale Everybody has an account so it does not really matter.

Re: “Invalid Username or Password”: a useless security measure (2014)

#239

Post by jstarfish »

MichaelCollins wrote: post #160
samwillis wrote: post #150

Earlier quoted context omitted.

The vast majority of the time the number one priority is reducing friction before a conversion. As much as a email confirmation prior to completion is more secure, the business case is far less strong. Customers can fix their email later, they can contact customer support if they got something wrong. Get them in the door ASAP, and either using the account, or complete an order. Don't redirect them to their email wher…

If reducing friction is the priority, then maybe skip email completely. Let people sign up with any username and don't require an email at all, like HN allows. Most sites that require an email don't need an email, and only ask for it so they can spam users with nonsense like product updates.

> Most sites that require an email don't need an email, and only ask for it so they can spam users with nonsense like product updates.

Not the only reason. It adds friction for people trying to create an army of sockpuppet accounts.

Re: “Invalid Username or Password”: a useless security measure (2014)

#240

Post by Spooky23 »

samwillis wrote: post #150
darrinmn wrote: post #80

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This is not true if the signup flow is implemented correctly. Signing up for an account should always respond with the same message "we sent an email for you to confirm your account signup". The owner of…

The vast majority of the time the number one priority is reducing friction before a conversion. As much as a email confirmation prior to completion is more secure, the business case is far less strong. Customers can fix their email later, they can contact customer support if they got something wrong. Get them in the door ASAP, and either using the account, or complete an order. Don't redirect them to their email wher…

Even an async validation would be better. I have @gmail.com, and get several newspapers and some other subscriptions for free.

In one case, a person named Mary in Australia sends their loved one a gift card every year, and the retailer doesn’t provide any information about Mary. In another case, a student missed out on their work study job and a opportunity for early class enrollment due to a bad email.

It’s sad as all of these customers don’t even know that they have a problem.

Post reply on HN