Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Username or password is incorrect” is bullshit

hackernoon.com

Post reply on HN
Print view View original

41–50 of 170 posts

Re: “Username or password is incorrect” is bullshit

#41

Post by dagw »

IshKebab wrote: post #26
tuxxy wrote: post #18

Earlier quoted context omitted.

The application doesn't know if the username you entered is actually yours or someone else's. You could provide the correct password to your account 'test', but not 'ttest'. The server just tells you to check both instead, it's more semantically correct and offers some security improvements with user enumeration.

It knows if it doesn't exist though. This whole thing is about sites that say "Username or password is wrong" when they know the username is wrong because it doesn't exist!

What if a username does exists, but isn't my username.

Imagine both 'dave' and 'davr' have an account. I'm 'dave', but I accidentally type 'davr' and my correct password. Now the site will tell me that my password is wrong. So I retype and retype my password over and over again and still can't log in, because the problem isn't the password like the error message says, but rather that I typed the wrong my username.

Re: “Username or password is incorrect” is bullshit

#43

Post by ChrisMorrisOrg »

cdancette wrote: post #32

Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public. So for login: always say "email or password is incorrect". And for register: as he said, always say "we sent you an email to verify your email".

Precisely this. The title of this article should probably be renamed because it's looking at specific examples where the whole process (ie login + registration flows) hasn't been implemented properly.

Re: “Username or password is incorrect” is bullshit

#44

Post by davrosthedalek »

The title is "bullshit". The real problem is that they leak the information they try not to leak anyway, on a different form. This is a common, but not universal, problem.

It's not OK to leak information, even if that information is maybe leaked somewhere else already.

Re: “Username or password is incorrect” is bullshit

#45

Post by croon »

cdancette wrote: post #32

Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public. So for login: always say "email or password is incorrect". And for register: as he said, always say "we sent you an email to verify your email".

Edge case: For services which uses an additional account name/alias (separate from email), where you can login with either account name or email; An attacker could find a target account name through signup, using an email the attacker owns.

Re: “Username or password is incorrect” is bullshit

#46

Post by arrrg »

GlitchMr wrote: post #40

I have an argument for "username or password is incorrect" messages: it's possible that the password is correct, username exists but isn't the intended one. Then "password is incorrect" message would be lying, as the issue is actually with a username.

Optimizing for the common case seems prudent here.

Re: “Username or password is incorrect” is bullshit

#47

Post by jwilk »

GlitchMr wrote: post #40

I have an argument for "username or password is incorrect" messages: it's possible that the password is correct, username exists but isn't the intended one. Then "password is incorrect" message would be lying, as the issue is actually with a username.

"password is incorrect" would be technically correct, perhaps not as helpful as it could be, but certainly not "lying".

Re: “Username or password is incorrect” is bullshit

#48

Post by ChrisMorrisOrg »

wyuenho wrote: post #35
cdancette wrote: post #32

Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public. So for login: always say "email or password is incorrect". And for register: as he said, always say "we sent you an email to verify your email".

Except that when you are signing up, unless the service is using some draconian password formatting rules, any "email or password is incorrect" error can be inferred as the email is incorrect, and if the email format is correct, it's must likely because the email was taken. "email or password is incorrect" is bullshit is right.

Can you please give an example? I don't think I understand what you're saying.

Re: “Username or password is incorrect” is bullshit

#49

Post by croon »

wyuenho wrote: post #35
cdancette wrote: post #32

Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public. So for login: always say "email or password is incorrect". And for register: as he said, always say "we sent you an email to verify your email".

Except that when you are signing up, unless the service is using some draconian password formatting rules, any "email or password is incorrect" error can be inferred as the email is incorrect, and if the email format is correct, it's must likely because the email was taken. "email or password is incorrect" is bullshit is right.

Either you or I misunderstood GP. I understood it as if (as long as any email format validation allows the address) the service only outputs "sent you an email for confirmation", even if the email is registered. The attacker wouldn't know if it was the first time or the 50th time that message had been shown, as it's always the same.

Re: “Username or password is incorrect” is bullshit

#50

Post by cdancette »

croon wrote: post #45
cdancette wrote: post #32

Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public. So for login: always say "email or password is incorrect". And for register: as he said, always say "we sent you an email to verify your email".

Edge case: For services which uses an additional account name/alias (separate from email), where you can login with either account name or email; An attacker could find a target account name through signup, using an email the attacker owns.

True.

For this I would recommend adding the mention "your username will be publicly visible" during the registration process.

Post reply on HN