Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Username or password is incorrect” is bullshit

hackernoon.com

Post reply on HN
Print view View original

51–60 of 170 posts

Re: “Username or password is incorrect” is bullshit

#51

Post by menacingly »

aglionby wrote: post #23
tuxxy wrote: post #15

Earlier quoted context omitted.

Typically, yes. This post didn't really offer any new insight to this. Maybe it's a PSA? Either way, it completely depends on the site's threat model. In the case of GitHub, it's quite useless because a user can just go to the targets's profile to see if it exists. Thus, it really isn't in GitHub's threat model, obviously. Where it gets really interesting is when you perform user enumeration attacks via timing. IE: i…

Is this possible to detect despite external factors (variable latency etc)?

It's black magic to me, but I'm paranoid about timing attacks after seeing a few examples in the past of what's possible for a clever attacker to guess if they can gather data from a number of requests.

Re: “Username or password is incorrect” is bullshit

#52

Post by tzs »

1ba9115454 wrote: post #17

The solution is relatively simple. 1. Email and password for login. Don't tell the attacker which is correct. 2. Email and password for registration. On registration send confirmation email. If user is already register attacker would need access to their email. Access to email is game over. So now an attacker can't see which users are registered with your service and you've protected your customers privacy. Extra poi…

> 2. Email and password for registration. On registration send confirmation email.

This opens up a different problem. It should be:

2. Email only for tentative registration. On tentative registration, send confirmation email.

3. User clicks link in confirmation email, which takes to page for setting password. (Alternatively, confirmation email includes randomly generated initial password, user is required to change it on first login). After password is set, registration changes from tentative to confirmed.

If email and password are both included on the initial registration form, an attacker can try to sign up people and some fraction of those people will accidentally click the link in the confirmation email, thereby resulting in some new accounts where the attacker knows the email and password, and the email owner does not know the password.

Re: “Username or password is incorrect” is bullshit

#53

Post by zimbatm »

davrosthedalek wrote: post #44

The title is "bullshit". The real problem is that they leak the information they try not to leak anyway, on a different form. This is a common, but not universal, problem. It's not OK to leak information, even if that information is maybe leaked somewhere else already.

In the GitHub case the handles are public information. Anyone can go to " rel="nofollow">https://github.com/ to verify if it exists. So they trade off usability of a clear error message for no gain at all.

Re: “Username or password is incorrect” is bullshit

#54

Post by [deleted] »

rodorgas wrote: post #37
tome wrote: post #11

Earlier quoted context omitted.

Because the application doesn't know what is actually wrong. The error message is actually correct as written. The user entered their username incorrectly or their password incorrectly, or both. The application doesn’t know which and shouldn’t guess!

This is true for existing user with wrong password, but that message would be wrong if the user doesn't exist. In this case, the error clearly would be the username, not the combination user+pass.

[deleted]

Re: “Username or password is incorrect” is bullshit

#55

Post by travisjeffery »

croon wrote: post #49
wyuenho wrote: post #35

Earlier quoted context omitted.

Except that when you are signing up, unless the service is using some draconian password formatting rules, any "email or password is incorrect" error can be inferred as the email is incorrect, and if the email format is correct, it's must likely because the email was taken. "email or password is incorrect" is bullshit is right.

Either you or I misunderstood GP. I understood it as if (as long as any email format validation allows the address) the service only outputs "sent you an email for confirmation", even if the email is registered. The attacker wouldn't know if it was the first time or the 50th time that message had been shown, as it's always the same.

Correct. The UI message would always be the same, some variant of "email sent." Even if the account already existed and it wasn't actually a successful sign up of a new account.

Re: “Username or password is incorrect” is bullshit

#56

Post by ajuc »

GlitchMr wrote: post #40

I have an argument for "username or password is incorrect" messages: it's possible that the password is correct, username exists but isn't the intended one. Then "password is incorrect" message would be lying, as the issue is actually with a username.

You mean you log onto John with password 12345 and the website says "Some other user uses this password, but not John"?

Seems wrong, somehow.

Re: “Username or password is incorrect” is bullshit

#57

Post by bo1024 »

cdancette wrote: post #32

Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public. So for login: always say "email or password is incorrect". And for register: as he said, always say "we sent you an email to verify your email".

Why? I don't see why it's important to hide existence of a user unless you're allowing people to try multiple logins per second on your site. (I'm not an expert so I am sincerely asking to help me understand.)

Re: “Username or password is incorrect” is bullshit

#58

Post by travisjeffery »

GlitchMr wrote: post #40

I have an argument for "username or password is incorrect" messages: it's possible that the password is correct, username exists but isn't the intended one. Then "password is incorrect" message would be lying, as the issue is actually with a username.

This is a better argument, but rarely given. The issue is the accepted argument made for 'username or password is incorrect' is it's a best practice protecting the existence of accounts on sign ins, yet sign ups are ignored.

Re: “Username or password is incorrect” is bullshit

#59

Post by cdancette »

bo1024 wrote: post #57
cdancette wrote: post #32

Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public. So for login: always say "email or password is incorrect". And for register: as he said, always say "we sent you an email to verify your email".

Why? I don't see why it's important to hide existence of a user unless you're allowing people to try multiple logins per second on your site. (I'm not an expert so I am sincerely asking to help me understand.)

If your users want to disclose that information, provide them a way to make a public profile if they want to, and if it makes sense. Don't assume their intentions. They might have good reasons you didn't think of.

Re: “Username or password is incorrect” is bullshit

#60

Post by avian »

bo1024 wrote: post #57
cdancette wrote: post #32

Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public. So for login: always say "email or password is incorrect". And for register: as he said, always say "we sent you an email to verify your email".

Why? I don't see why it's important to hide existence of a user unless you're allowing people to try multiple logins per second on your site. (I'm not an expert so I am sincerely asking to help me understand.)

For some websites, people might not want others to be able to find out whether they have registered if they only know their email address (e.g. same kind of websites for which the incognito/private mode exists in browsers).
Post reply on HN