“Invalid username or password” is a useless security measure • Hacker News Board

Re: “Invalid username or password” is a useless security measure

#41

Post by baddox » Mon, Dec 01, 2014, 7:47 PM UTC

tetrep wrote: post #30

>99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. While this is true, it's perfectly reasonable to require a captcha before allowing a new account to be created; greatly limiting the speed at which an attacker could enumerate emails. While it's not going…

But requiring a captcha before validating the uniqueness of each username would be pretty annoying for large websites where many of the usernames I would choose are already taken.

Re: “Invalid username or password” is a useless security measure

#42

Post by paublyrne » Mon, Dec 01, 2014, 7:48 PM UTC

tacostakohashi wrote: post #3

Leaving security aside, "incorrect username/password" is still the more correct and useful statement. Consider the case where you mistype your username (email). For sites like amazon, gmail, hotmail, yahoo, twitter, etc, it is entirely likely that the mistyped username is somebody else's valid username, you typed the password correctly, and "incorrect password" would hide the problem.

More likely, people won't forget how to spell their email address, or make a mistake in typing it that isn't immediately obvious; they might not remember which of their emails they used to sign up, though, even if they only have a couple. No one else can sign up with an email address that belongs to you.

Re: “Invalid username or password” is a useless security measure

#43

Post by andrewstuart2 » Mon, Dec 01, 2014, 7:48 PM UTC

baddox wrote: post #38

rrrx3 wrote: post #22

Earlier quoted context omitted.

That statement doesn't help the user fix a problem. Either you tell the user that one of the items is incorrect - "This password does not match our records" or "This user name does not match our records". Simply stating "Incorrect username/password" isn't sufficient enough information to prevent the user from making the same error (or even a different one) again. Here's what I tell the developers I work with: Design…

You didn't really address the parent's point, which is that their misspelled username might match another real username. In this case, telling them that their password is incorrect is actively sending them down the wrong path, because they are likely to try fixing the password field rather than the username field.

Telling them "correct password, wrong email" seems like a bit of an information leak if you ask me.

I think a "did you mean?" output in case of a bad password as long as there are lexically similar usernames in the database.

Re: “Invalid username or password” is a useless security measure

#44

Post by masklinn » Mon, Dec 01, 2014, 7:49 PM UTC

why-el wrote: post #13

None of the author's recommendations conflict with the practice he is advocating against. I think websites say "Bad combination" not because usernames are treated equally with passwords, but because you don't have a choice but say that. If I tell you that your username is incorrect, am I telling you your password isn't? This would be silly, because if the website is new and I know a password is correct, then I can ei…

> I think websites say "Bad combination" not because usernames are treated equally with passwords, but because you don't have a choice but say that.

Of course you do.

> If I tell you that your username is incorrect, am I telling you your password isn't? This would be silly

Of course it is, a password is checked against a username, not against the whole database. If the site is telling you the username is incorrect it's telling you just that: the username is incorrect. It wasn't able to go any further and check the password since it has no idea which password it should check for (or even, if you're correctly storing passwords, which salt it should use for the password check). Your criticism doesn't even make sense.

Re: “Invalid username or password” is a useless security measure

#45

Post by baddox » Mon, Dec 01, 2014, 7:49 PM UTC

cryptoz wrote: post #7

This doesn't address timing attacks, which are why this is done in the first place. If the code checks only for a username existing and returns the error message, this takes a measurably different amount of time compared to then also looking up if the password matches. The error shown isn't to dissuade people from using web pages to try to gain access to accounts - it's because the raw code itself doesn't know which…

I feel like the variance in network latency is going to be an orders of magnitude larger than the extra time it takes to test a password.

Re: “Invalid username or password” is a useless security measure

#46

Post by Spooky23 » Mon, Dec 01, 2014, 7:51 PM UTC

masklinn wrote: post #26

darrhiggs wrote: post #18

The article misses the point that on many sites this is not a security feature, more a privacy one. I have used the 403 http status rather than 401 in the past for this exact reason. RFC 7231[0] suggests something similar "An origin server that wishes to "hide" the current existence of a forbidden target resource MAY instead respond with a status code of 404 (Not Found)." with RFC 7235[1] suggesting the use of 403. "…

As the article notes, you can trivially get around that "privacy feature" by trying to sign up with the email. If it lets you sign up there was nobody there, if it does not the email is being used by somebody else. Most sites will reject you immediately if the email is already in the system. > RFC 7231[0] suggests something similar Well no, RFC 7231 suggests that rather than telling an authenticated user he does not…

If it matters, you can make it non-trivial. As with most privacy attacks, you can target an individual pretty easily.

But, if you're trolling for lots of users, the "new account" feature will have a much lower operational tempo than the authentication workflow, and for a privacy conscious organization, you can do things to make it harder for attackers. Examples: Captcha, data input validation, risk scoring, don't provide immediate confirmation, etc.

Revealing that the email address is a valid system account isn't a particularly useful piece of information to a user who isn't remembering a password. john.smith100000@gmail.com is probably taken by another John Smith. It just isn't a useful piece of information.

Re: “Invalid username or password” is a useless security measure

#47

Post by raverbashing » Mon, Dec 01, 2014, 7:52 PM UTC

tracker1 wrote: post #34

anigbrowl wrote: post #14

Unfortunately this assumes that there's no other way for an attacker to discover whether a username/email address is registered for a service. This assumption is incorrect. No it doesn't. It assumes, correctly, that that involves a bunch of extra work and that obfuscation raises the economic cost of an attack.

Really!?! An attacker can just as easily write a script to check the password recovery form before attacking the login form. You're taking something that is easy to automate and using it as a solution that makes it harder for people to use. How many times have you been to a site you haven't used in a while to try several different passwords, only to hit the password reset form and discover the username wasn't even co…

A lot of places have a captcha in their sign up process.

Also signing up usually involves more than a login/password (address, phone no., etc)

Yeah, someone could do something like "you'll get an email if this email wasn't registered already" on sign up

Re: “Invalid username or password” is a useless security measure

#48

Post by [deleted] » Mon, Dec 01, 2014, 7:53 PM UTC

why-el wrote: post #13

None of the author's recommendations conflict with the practice he is advocating against. I think websites say "Bad combination" not because usernames are treated equally with passwords, but because you don't have a choice but say that. If I tell you that your username is incorrect, am I telling you your password isn't? This would be silly, because if the website is new and I know a password is correct, then I can ei…

[deleted]

Re: “Invalid username or password” is a useless security measure

#49

Post by masklinn » Mon, Dec 01, 2014, 7:54 PM UTC

cryptoz wrote: post #7

This doesn't address timing attacks, which are why this is done in the first place. If the code checks only for a username existing and returns the error message, this takes a measurably different amount of time compared to then also looking up if the password matches. The error shown isn't to dissuade people from using web pages to try to gain access to accounts - it's because the raw code itself doesn't know which…

> This doesn't address timing attacks, which are why this is done in the first place.

This is not done because of timing attacks, it's done because of cargo-cultism and laziness.

> The error shown isn't to dissuade people from using web pages to try to gain access to accounts - it's because the raw code itself doesn't know which is which

Modern systems store passwords salted and hashed with KDFs. The stored hash must be retrieved before the provided password can be checked as you need the stored hash's work factor and salt, which are stored alongside (/as part of) the hash. Such a system necessarily knows which is which.

Re: “Invalid username or password” is a useless security measure

#50

Post by crumpled » Mon, Dec 01, 2014, 7:54 PM UTC

baddox wrote: post #38

rrrx3 wrote: post #22

Earlier quoted context omitted.

That statement doesn't help the user fix a problem. Either you tell the user that one of the items is incorrect - "This password does not match our records" or "This user name does not match our records". Simply stating "Incorrect username/password" isn't sufficient enough information to prevent the user from making the same error (or even a different one) again. Here's what I tell the developers I work with: Design…

You didn't really address the parent's point, which is that their misspelled username might match another real username. In this case, telling them that their password is incorrect is actively sending them down the wrong path, because they are likely to try fixing the password field rather than the username field.

facebook handles this case by showing the profile picture of the user matching the email field.

banks and yahoo handle this case by showing a magic image that you chose, which also provides anti-phishing feedback