Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid Username or Password”: a useless security measure (2014)

kevin.burke.dev

Post reply on HN
Print view View original

251–260 of 289 posts

Re: “Invalid Username or Password”: a useless security measure (2014)

#251

Post by cryptoegorophy »

layer8 wrote: post #153
cryptoegorophy wrote: post #144

Earlier quoted context omitted.

Woocommerce plug-in of Wordpress solved that issue. You can checkout as a guest with someone else’s email, you won’t see other orders from that email and if you do want to see them then you need to sign up for an account

What if it wasn’t someone else’s email, but your own with an existing account? Can you re-associate your order with the existing account?

It can only be done manually by admin upon request. Otherwise if you are not logged in then you have a guest order.

Re: “Invalid Username or Password”: a useless security measure (2014)

#252

Post by sgjohnson »

Sohcahtoa82 wrote: post #176
sgjohnson wrote: post #13

I'd say it's wrong to assume it's even a security measure. I'm fairly sure it goes like this if (db->query("SELECT * FROM `users` WHERE `email` = 'yesthisisdog@gmail.com' AND `password` = MD5('hunter2')") { login(username); } else { error('invalid username or password'); } with nobody giving it a second thought.

Everything about that query makes me cry.

Thanks, I tried

Re: “Invalid Username or Password”: a useless security measure (2014)

#253

Post by thomastjeffery »

ad404b8a372f2b9 wrote: post #247
thomastjeffery wrote: post #244

Earlier quoted context omitted.

There's only one UX path that doesn't involve email, apart from just logging in, and that's when you do know the password, but don't know the email. In that case, you probably only have few enough email addresses to try that that isn't an issue. In every other path, you will definitely be waiting (hopefully not long) for an email, so what does it matter?

Imagine you're an average person and you have 3 emails and 3 passwords that you typically (and repeatedly) use, in any combination. (That's pretty much every non-software person I know, and me on every site before I started using a password manager) To login you have to try 9 combinations, but your account will be frozen after 3 wrong tries. The log-in screen does not tell you whether you have the wrong email or the…

1. Password reuse is bad.

2. Not getting the email immediatly is an edge case. Any reasonably good system will send it immediatly.

3. You would save yourself a lot of time and energy just using a password manager. No more trying. No more remembering.

Re: “Invalid Username or Password”: a useless security measure (2014)

#254

Post by ad404b8a372f2b9 »

thomastjeffery wrote: post #253
ad404b8a372f2b9 wrote: post #247

Earlier quoted context omitted.

Imagine you're an average person and you have 3 emails and 3 passwords that you typically (and repeatedly) use, in any combination. (That's pretty much every non-software person I know, and me on every site before I started using a password manager) To login you have to try 9 combinations, but your account will be frozen after 3 wrong tries. The log-in screen does not tell you whether you have the wrong email or the…

1. Password reuse is bad. 2. Not getting the email immediatly is an edge case. Any reasonably good system will send it immediatly. 3. You would save yourself a lot of time and energy just using a password manager. No more trying. No more remembering.

Please read the disclaimer in the first message of this thread (which has not been edited since you replied to it).

I am describing real, widespread user behaviour, and real numerous websites. Responding "the user is dumb" or "the problem does not exist" is not how you design good U.X for your users.

Re: “Invalid Username or Password”: a useless security measure (2014)

#255

Post by gumby »

danjc wrote: post #121
gumby wrote: post #112

Related question: what's the deal with having a login form that only takes a username, and then only shows a password field after you've pressed enter? I find this very annoying and can't come up with a benefit.

SSO handoff as a sibling points out but also once email is known, a determination is made about trust level for the sign in attempt. Cookies, IP and other fingerprinting are used to determine whether single or double factor auth is required.

thanks.

Re: “Invalid Username or Password”: a useless security measure (2014)

#256

Post by gumby »

kozziollek wrote: post #116
gumby wrote: post #112

Related question: what's the deal with having a login form that only takes a username, and then only shows a password field after you've pressed enter? I find this very annoying and can't come up with a benefit.

If username is an e-mail then an app probably checks if e-mail domain has configured single sign on (SSO) and, if it has, it redirect you to your company authentication server instead of asking for password.

thanks

Re: “Invalid Username or Password”: a useless security measure (2014)

#257

Post by bloomingeek »

What if Google won't let you have your gmail account back? I broke my cellphone, so I went to the same carrier and purchased another Samsung, same phone number, but different model. So when I go to log into my Google account with the new cell, Google sends me a two way code, But to the old cellphone!

After days of trying to get into my account, I finally have to create a new account and email address. (yes, I know NOW there are ways to create a safety backup.) The phrase, "Invalid Username or Password" started showing up in my dreams.

Re: “Invalid Username or Password”: a useless security measure (2014)

#258

Post by uxp »

Spooky23 wrote: post #240
samwillis wrote: post #150

Earlier quoted context omitted.

The vast majority of the time the number one priority is reducing friction before a conversion. As much as a email confirmation prior to completion is more secure, the business case is far less strong. Customers can fix their email later, they can contact customer support if they got something wrong. Get them in the door ASAP, and either using the account, or complete an order. Don't redirect them to their email wher…

Even an async validation would be better. I have @gmail.com, and get several newspapers and some other subscriptions for free. In one case, a person named Mary in Australia sends their loved one a gift card every year, and the retailer doesn’t provide any information about Mary. In another case, a student missed out on their work study job and a opportunity for early class enrollment due to a bad email. It’s sad as a…

Validating any contact method that has the potential of sending PII, Health, or financial data should be mandatory by law.

At least once a year I get an automated phone call from a regional hospital letting me know some minor's test results. Calling the hospital's CS department in order to notify them or somehow get my phone number removed from the account is impossible, because I'm not this person nor their legal guardian and HIPAA regulations prevent me from instigating a change on someone else's medical records or accounts.

Re: “Invalid Username or Password”: a useless security measure (2014)

#259

Post by croes »

fefe23 wrote: post #4

Oh boy. This is actually a good point. I guess having the nondescript error message has always been "best practices" or maybe it has crossed the road and has become cargo cult now.

How do you know the user typed the wrong password and didn't mistype his user name that happens to be someone else's user name?

Re: “Invalid Username or Password”: a useless security measure (2014)

#260

Post by croes »

tromp wrote: post #234
kahrl wrote: post #197

Earlier quoted context omitted.

I'd prefer to not create brute force vulnerability that leaks the site's list of user email addresses to an attacker.

As the article points out, this leaks it no more than trying to register an email address.

Which can be prevented by sending an confirmation email at a signup, no matter if a new account or an existing one.
Post reply on HN