Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid username or password” is a useless security measure

kev.inburke.com

Post reply on HN
Print view View original

31–40 of 188 posts

Re: “Invalid username or password” is a useless security measure

#31

Post by tracker1 »

why-el wrote: post #13

None of the author's recommendations conflict with the practice he is advocating against. I think websites say "Bad combination" not because usernames are treated equally with passwords, but because you don't have a choice but say that. If I tell you that your username is incorrect, am I telling you your password isn't? This would be silly, because if the website is new and I know a password is correct, then I can ei…

If the username is wrong, and you don't tell them, they will spend several tries on passwords that will never work.. because the user is invalid.

I have a number of sites I don't use often, that I wind up having to do a password reset on to then find out I'm not even using the right username... there was literally no gain from this... Any hacking attempt can do the same to determine if a username was valid or not.

It's making things easy for machines to do harder for people to do, which is the wrong approach to security.

Re: “Invalid username or password” is a useless security measure

#32

Post by spion »

why-el wrote: post #13

None of the author's recommendations conflict with the practice he is advocating against. I think websites say "Bad combination" not because usernames are treated equally with passwords, but because you don't have a choice but say that. If I tell you that your username is incorrect, am I telling you your password isn't? This would be silly, because if the website is new and I know a password is correct, then I can ei…

"Sorry, we don't have a in our database" isn't misleading. If the user enters an incorrect password too, the subsequent message "Invalid password for " will let them correct it.

Re: “Invalid username or password” is a useless security measure

#33

Post by andrewstuart2 »

mbesto wrote: post #23

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. That's terrible UX. > But there's a tradeoff there between security and UX, I hear you say. I am trying to show you there is no tradeoff; you are choosing between a better user experience and a worse use…

> That's terrible UX.

I think the goal when the User is a malicious attacker is for them to have a terrible UX.

Re: “Invalid username or password” is a useless security measure

#34

Post by tracker1 »

anigbrowl wrote: post #14

Unfortunately this assumes that there's no other way for an attacker to discover whether a username/email address is registered for a service. This assumption is incorrect. No it doesn't. It assumes, correctly, that that involves a bunch of extra work and that obfuscation raises the economic cost of an attack.

Really!?! An attacker can just as easily write a script to check the password recovery form before attacking the login form.

You're taking something that is easy to automate and using it as a solution that makes it harder for people to use.

How many times have you been to a site you haven't used in a while to try several different passwords, only to hit the password reset form and discover the username wasn't even correct? How many minutes of your time were wasted? How much security was actually added?

The answers are... Yes. Too much. None.

Re: “Invalid username or password” is a useless security measure

#36

Post by [deleted] »

cryptoz wrote: post #7

This doesn't address timing attacks, which are why this is done in the first place. If the code checks only for a username existing and returns the error message, this takes a measurably different amount of time compared to then also looking up if the password matches. The error shown isn't to dissuade people from using web pages to try to gain access to accounts - it's because the raw code itself doesn't know which…

[deleted]

Re: “Invalid username or password” is a useless security measure

#37

Post by weinzierl »

tacostakohashi wrote: post #3

Leaving security aside, "incorrect username/password" is still the more correct and useful statement. Consider the case where you mistype your username (email). For sites like amazon, gmail, hotmail, yahoo, twitter, etc, it is entirely likely that the mistyped username is somebody else's valid username, you typed the password correctly, and "incorrect password" would hide the problem.

"You don't exist. Go away." is my personal favourite.

Re: “Invalid username or password” is a useless security measure

#38

Post by baddox »

rrrx3 wrote: post #22
tacostakohashi wrote: post #3

Leaving security aside, "incorrect username/password" is still the more correct and useful statement. Consider the case where you mistype your username (email). For sites like amazon, gmail, hotmail, yahoo, twitter, etc, it is entirely likely that the mistyped username is somebody else's valid username, you typed the password correctly, and "incorrect password" would hide the problem.

That statement doesn't help the user fix a problem. Either you tell the user that one of the items is incorrect - "This password does not match our records" or "This user name does not match our records". Simply stating "Incorrect username/password" isn't sufficient enough information to prevent the user from making the same error (or even a different one) again. Here's what I tell the developers I work with: Design…

You didn't really address the parent's point, which is that their misspelled username might match another real username. In this case, telling them that their password is incorrect is actively sending them down the wrong path, because they are likely to try fixing the password field rather than the username field.

Re: “Invalid username or password” is a useless security measure

#39

Post by allendoerfer »

The article does not point out, that not teling visitors which of password and username were wrong on login pages is a useless measure, it shows that there is a second way to find out correct registered email addresses on most platforms (by trying to register them).

This can be easily fixed by sending email conformation tokens prior to creating the user account and informing users in this email, in case they already have an account.

Re: “Invalid username or password” is a useless security measure

#40

Post by saidajigumi »

mbesto wrote: post #23

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. That's terrible UX. > But there's a tradeoff there between security and UX, I hear you say. I am trying to show you there is no tradeoff; you are choosing between a better user experience and a worse use…

> That's terrible UX.

Your complaint is extremely unclear. Could you elaborate? Are you suggesting that websites should allow multiple accounts per email address as a matter of course?

Post reply on HN