Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid Username or Password”: a useless security measure (2014)

kevin.burke.dev

Post reply on HN
Print view View original

271–280 of 289 posts

Re: “Invalid Username or Password”: a useless security measure (2014)

#271

Post by mcv »

One of the comments there says:

> Heh, after an independent security review we are being forced to take this even further; We lock people out for five minutes after three invalid login attempts. We are no longer allowed to tell users they have been locked out. So, even if they do remember their password (or even does a reset) we just have to tell them their uid/pwd is wrong when they try to log in. And for “forgot password”? Just tell the user “we have sent you an email – IF we recognised the email you put in”.

This sounds absolutely horrible, and now I'm wondering if I've been subject to this behaviour. Couldn't remember my password (for a trivial site where I use one of my reuse passwords and didn't put it in KeePass), started doubting if I had the correct email, eventually reset the whole thing, reset the password to the password that I thought it should have been, and got an error telling me the new password couldn't be the same as the old one.

Re: “Invalid Username or Password”: a useless security measure (2014)

#272

Post by mcv »

Terretta wrote: post #241
MostlyInnocent wrote: post #152

The article makes a good point, were it not for security auditors (SAs). SA: You leak information and therefore violate policy by disclosing on the login form whether an account exists or not! Me: Yeah, but figuring out if an account exists is really simple anyway: just a query to a different endpoint... SA: NEVERMIND, MY LAD: disclosing account existence upon login violates BEST PRACTICES! Me: OK, yeah, whatever, we…

Every well known credit card / credit data breach has been of a PCI-DSS compliant party. To any SAs reading this: you're not secure because you're compliant.

The big issue there is that they store credit card data at all.

And of course that some simple public number is enough to authorise payment.

Re: “Invalid Username or Password”: a useless security measure (2014)

#273

Post by lakomen »

First of all, Fuck 2FA! 2FA = companies fishing for phone numbers to identify and track you.

This post is from 2014.

Meanwhile I suggested that an any login attempt you would receive an email, you don't have to know your password to the service.

Effectively Microsoft is the only company doing it like this. You don't need a password, every time you log in you can opt to have a login link sent to your email address instead of using a password.

That IMHO makes sense. And I'd go one step further. Anytime anyone tries to use your service, don't ask a password, just ask for their email address. The most detrimental or annoying part of a sign up process is picking a password and worse, some stupid services demand you repeat your email or password.

Let the user sign up effortlessly.

I won't even start about how awful captcha is. If you use a JS form and means of sign up or login you don't need captcha.

Re: “Invalid Username or Password”: a useless security measure (2014)

#274

Post by dietketchup »

uxp wrote: post #258
Spooky23 wrote: post #240

Earlier quoted context omitted.

Even an async validation would be better. I have @gmail.com, and get several newspapers and some other subscriptions for free. In one case, a person named Mary in Australia sends their loved one a gift card every year, and the retailer doesn’t provide any information about Mary. In another case, a student missed out on their work study job and a opportunity for early class enrollment due to a bad email. It’s sad as a…

Validating any contact method that has the potential of sending PII, Health, or financial data should be mandatory by law. At least once a year I get an automated phone call from a regional hospital letting me know some minor's test results. Calling the hospital's CS department in order to notify them or somehow get my phone number removed from the account is impossible, because I'm not this person nor their legal gu…

Don't call CS. File a HIPAA complaint. The provider who is sharing PHI illegally will certainly care. They have no duty to validate the phone number, but they do have to respond to a complaint saying they shared PHI with a person who is not THE person.

Re: “Invalid Username or Password”: a useless security measure (2014)

#275

Post by quacksilver »

listenallyall wrote: post #263
quacksilver wrote: post #226

Earlier quoted context omitted.

Could part of the pattern for requiring an email address (or phone number) at time of purchase be reduced customer support costs for the vendor. With an email address the customer can reset their own password for using their account with self service features - like get a duplicate invoice or view/change/cancel a reservation or similar stuff. Without an email address / phone number / something to link a customer to t…

You're missing his point. He's saying that the whole point of having an "account" is often not actually necessary. Domino's and Southwest are much more focused on making it as easy as possible to buy a pizza or a plane ticket, without an account being mandatory.

I was attempting to say it may be more convenient / less expensive for the vendor if all customers are forced to have self-service accounts rather than having to complain to manned customer service or via twitter or whatever.

Re: “Invalid Username or Password”: a useless security measure (2014)

#276

Post by account42 »

bluenotebo0k wrote: post #31

"99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address." Yes, but signing up is a more cumbersome process and usually has a CAPTCHA attached to it, unlike logging in.

Exactly. And please don't add CAPTCHAs to login.

Re: “Invalid Username or Password”: a useless security measure (2014)

#277

Post by account42 »

jstarfish wrote: post #239
MichaelCollins wrote: post #160

Earlier quoted context omitted.

If reducing friction is the priority, then maybe skip email completely. Let people sign up with any username and don't require an email at all, like HN allows. Most sites that require an email don't need an email, and only ask for it so they can spam users with nonsense like product updates.

> Most sites that require an email don't need an email, and only ask for it so they can spam users with nonsense like product updates. Not the only reason. It adds friction for people trying to create an army of sockpuppet accounts.

Not a lot of friction. Especially if you don't restrict the allowed email providers.

Re: “Invalid Username or Password”: a useless security measure (2014)

#278

Post by shantnutiwari »

mcv wrote: post #271

One of the comments there says: > Heh, after an independent security review we are being forced to take this even further; We lock people out for five minutes after three invalid login attempts. We are no longer allowed to tell users they have been locked out. So, even if they do remember their password (or even does a reset) we just have to tell them their uid/pwd is wrong when they try to log in. And for “forgot pa…

I felt this with LastPass. It put in some secret locked mode, and wouldnt let me login even wit h right password. 3-4 hours later, it just started working. I was a paying customer, didnt get any replies to my emails.

It pissed me off so much I moved to 1Password AND Bitwarden -- 2 in parallel, so if anyone pulls this on me again I can immedietely move to the other

Re: “Invalid Username or Password”: a useless security measure (2014)

#279

Post by matt-attack »

marcosdumay wrote: post #169
MichaelCollins wrote: post #160

Earlier quoted context omitted.

If reducing friction is the priority, then maybe skip email completely. Let people sign up with any username and don't require an email at all, like HN allows. Most sites that require an email don't need an email, and only ask for it so they can spam users with nonsense like product updates.

Any site that requires a password will need an email for password resets.

I’ve had my Reddit account for 15 years. Never given them an email.

Re: “Invalid Username or Password”: a useless security measure (2014)

#280

Post by gamzer »

If the goal is to log in new users immediately after registration, is it possible to not leak whether a username is already registered?

If hn@example.com is not registered and I register it, I will be logged in (even if it does not belong to me).

If hn@example.com is already registered, the site can neither let me register it nor log me in.

Post reply on HN