Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid Username or Password”: a useless security measure (2014)

kevin.burke.dev

Post reply on HN
Print view View original

61–70 of 289 posts

Re: “Invalid Username or Password”: a useless security measure (2014)

#61

Post by selykg »

capableweb wrote: post #37
herendin2 wrote: post #33

Earlier quoted context omitted.

You can provide a more helpful error message by explicitly informing the user that the username they typed exists but they haven't offered the correct password for it. Unless the site searches to find out which username the entered password actually corresponds to (which is a whole new, terribly dangerous, can of worms), it can't do better than that Because any malicious player can easily check whether usernames exis…

It doesn't seem like the author is arguing that just because you can instead validate if the email exists on a platform via the signup page instead of the login page, the vague message can be removed, but rather that the signup page should remove the information leakage as well, so there is no leakage anywhere.

Depending on your particular service, there's a better alternative for not leaking the existing account. A service I worked on previously was super sensitive and we didn't want to leak the existence of an existing account. What we did instead was asked for the email on the first page of signup, we verified the email was active by sending an email and a link to continue signup. If they already have an account we'd inform them in that email that they already have an account.

This way, the attacker actually has to have access to the email in question to know that an existing account is present on the service.

If you do the whole signup process on a single page and validate the email there then yea, you're gonna have a rough time.

Re: “Invalid Username or Password”: a useless security measure (2014)

#62

Post by darkwater »

Xylakant wrote: post #18
sabellito wrote: post #8

Earlier quoted context omitted.

The author explains in the article that you're not protected from that case either, as the attacker can try to sign up with your email and find out anyway if that email is already registered.

Many services let you sign up with an existing email and just send a “you tried to sign up, but you seem to have an address already.” to the account owner. In that case it’s indistinguishable for the attacker. Many services already require email confirmation to finalize the signup process so the extra effort is low.

Off the top of my head, I cannot remember any site I use that works that way (which is also basically what TFA is suggesting to do as a trade-off implementation)

Re: “Invalid Username or Password”: a useless security measure (2014)

#63

Post by sgjohnson »

martius wrote: post #54
sgjohnson wrote: post #20

Earlier quoted context omitted.

OPSEC and user experience are completely unrelated things. If you have something to hide (from anyone at all), you have to employ opsec measures. Using an email account that can't be immediately linked back to you is the most basic of them (and would be perfectly sufficient in the scenario described). It wouldn't even matter if the website didn't leak in any way that an email is registered with them, because data bre…

Are they unrelated? The article is about a tradeoff between security and user experience, claiming that a given practice is bad experience without any security gain. The Ashley Madison leak shows that there are plenty of vulnerable users who are not educated to even "the most basic" things to do to protect their privacy. It's also a question of user experience to protect users against themselves, or against threats t…

> Are they unrelated?

Perhaps not when considering only the points made in the article, but in the grand scheme of things, yes.

If you’re worried about your opsec (not the sites, and if you’re worried about your opsec, you should treat the site as having no security measures whatsoever), ux is secondary to you, because in the case of a leak you should be in a position where you can plausibly deny everything. And you shouldn’t expect the site to help you with it.

Re: “Invalid Username or Password”: a useless security measure (2014)

#64

Post by progval »

baxtr wrote: post #34

> Here is an actual UX/security tradeoff: you can make the signup process email based. Great. Now I can’t share passwords any more with significant others. Instead I have to send them login credentials every time they want to login.

The author only recommends doing this on signup, ie. registration. Not on login.

Re: “Invalid Username or Password”: a useless security measure (2014)

#65

Post by pmontra »

sabellito wrote: post #8
martius wrote: post #6

There is also the question of leaking whether a given user has an account on a website or not. Maybe I don't want my employer to know that I have an account on competitor-service.com, or my partner to know that I have an account on kinky-thing.website. It might not be a security issue, but it could be a privacy issue.

The author explains in the article that you're not protected from that case either, as the attacker can try to sign up with your email and find out anyway if that email is already registered.

Xylakant explains how to cope with that in a sibling comment. Note that email is personal information often containing name, surname and maybe a likely year of birth (johndoe92@example.com). Leaking it is not OK in several legislations so we should take special care before telling someone that some person is or is not in our database.

Re: “Invalid Username or Password”: a useless security measure (2014)

#66

Post by prmph »

wongarsu wrote: post #32
Xylakant wrote: post #18

Earlier quoted context omitted.

Many services let you sign up with an existing email and just send a “you tried to sign up, but you seem to have an address already.” to the account owner. In that case it’s indistinguishable for the attacker. Many services already require email confirmation to finalize the signup process so the extra effort is low.

And those services also plug the forgotten-password information leak by just informing you "if you have an account, you got an email" instead of giving you an explicit success or error message. I guess the better point for the article would be "many websites cargo-cult the login error message without understanding why it's there and how that should impact the rest of the service"

> And those services also plug the forgotten-password information leak by just informing you "if you have an account, you got an email" instead of giving you an explicit success or error message.

This might be a better approach, but one problem I see with it is: what if the email is not actually delivered because of an internal bug in the website? How would users know they didn't receive an email they were supposed to have received, and take the appropriate action (trying again or contacting help), versus that they entered a wrong or unregistered email?

Re: “Invalid Username or Password”: a useless security measure (2014)

#67

Post by SamBam »

codingdave wrote: post #55

> Unfortunately this assumes that there's no other way for an attacker to discover whether a username/email address is registered for a service. This assumption is incorrect. Security is never perfect, it is always about making it annoying enough that people don't bother. So yes, there are other ways to see if someone has an account. But odds are the person attacking your site is not singling out one account to hack,…

> it is always about making it annoying enough that people don't bother.

> But odds are the person attacking your site is not singling out one account to hack, they are trying bulk attacks with many accounts.

I feel like these two statements are at odds with each other. A regular user is going to get annoyed. An attacker using a script and multiple attempts is simply going to include the other way of verifying if an address is real in the script.

Re: “Invalid Username or Password”: a useless security measure (2014)

#68

Post by SamBam »

kklisura wrote: post #60

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. So why not just send an email upon signup with existing email and just show success on signup? I'm guessing email would state that you already have an account there, maybe you need to reset password and…

The article suggests this. But also says you're going to make sign-up a lot more lossy because the context-switching may make some people give up.

Re: “Invalid Username or Password”: a useless security measure (2014)

#69

Post by drewcoo »

> Unfortunately this assumes that there's no other way for an attacker to discover whether a username/email address is registered for a service. This assumption is incorrect.

The assertion is incorrect. Closing a means to account name guessing does not presuppose that there are no other means available.

Locking my front door does not assume I have no other doors.

Re: “Invalid Username or Password”: a useless security measure (2014)

#70

Post by kgwxd »

codingdave wrote: post #55

> Unfortunately this assumes that there's no other way for an attacker to discover whether a username/email address is registered for a service. This assumption is incorrect. Security is never perfect, it is always about making it annoying enough that people don't bother. So yes, there are other ways to see if someone has an account. But odds are the person attacking your site is not singling out one account to hack,…

Maybe instead of saying the email address is already in use on the site, just let the "sign up" happen and tell them to check the email for a confirmation link, and in the confirmation email say "someone is attempting to sign up with this email that is already signed up, if this was you, use the Forgot Password link to reset the password for the existing account. If it was not, click here to report this incident."
Post reply on HN