Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Username or password is incorrect” is bullshit

hackernoon.com

Post reply on HN
Print view View original

91–100 of 170 posts

Re: “Username or password is incorrect” is bullshit

#91

Post by ryanbrunner »

pqh wrote: post #85
pornel wrote: post #71

The right answer isn't a blanket "sites should do this super-secret e-mail-only shuffle and not tell you anything". First, you should define your threat model: which information is considered secret and which isn't, and treat any violations as security vulnerabilities. If usernames are public by design, then don't hide them in one form, and expose in URLs elsewhere on the site. If exposing who's registered on your si…

default to privacy though, please

Not really. "Default to privacy" is what gives you insane useless UXes like the one in the article, where you're making login (already a frustrating experience) more painful with absolutely zero gain in security.

Default to knowing your threat model. Default to balancing security concerns with UX, and make an informed decision instead of blindly following best practices.

Re: “Username or password is incorrect” is bullshit

#92

Post by ivanbakel »

pornel wrote: post #71

The right answer isn't a blanket "sites should do this super-secret e-mail-only shuffle and not tell you anything". First, you should define your threat model: which information is considered secret and which isn't, and treat any violations as security vulnerabilities. If usernames are public by design, then don't hide them in one form, and expose in URLs elsewhere on the site. If exposing who's registered on your si…

I'm not sure the point made was as much "use this blanket solution" as "if you're aiming to do this, go all the way".

Obviously, Github and Stripe aren't actually enforcing these messages as part of some larger security policy, or if they are, they're doing it very poorly. But if they were, the email shuffle is what they ought to be doing.

Re: “Username or password is incorrect” is bullshit

#93

Post by [deleted] »

nhumrich wrote: post #78
brepl wrote: post #68

Earlier quoted context omitted.

If the username is used as the salt when storing the hashed password in the database, it's unpossible to know if a supplied password is valid-but-for-a-different-account.

Wow, using the user as the salt is awesome. Is this considered an ok security practice?

[deleted]

Re: “Username or password is incorrect” is bullshit

#94

Post by alephnil »

mdahlstrand wrote: post #80
u801e wrote: post #63

Not quite on topic, but it would be nice if more websites would offer the option of using client side TLS certificate "login" with or without an additional prompt for a username and password. It would be next to impossible for an attacker to bypass that. For example, even if the attacker provided the correct credentials, they most likely would not have the associated client-side TLS certificate private key. Then the…

Sounds like a great solution - would browsers need to support it? Do you have any resources on implementing it?

Browsers has supported it since the late nineties. The problem are on the practical side. If you ever log in from more than one machine, all must have your private key, and the mechanism for synchronising keys between machines are not there. You have to manually install your key each place. It has also been too hard for most people to make and handle public/private key pairs. Also, if you don't have the private key with you, there is no way you can log in to the site. All of these problem and many other usability problems would have to be solved for client side certificates to be a success.

Re: “Username or password is incorrect” is bullshit

#95

Post by ryanbrunner »

cdancette wrote: post #32

Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public. So for login: always say "email or password is incorrect". And for register: as he said, always say "we sent you an email to verify your email".

If you have a user name, why do you care about e-mail? Let people enter an arbitrary user name, and log in with that. Username enumeration doesn't carry privacy concerns since users can ensure their usernames don't reveal personal information. For duplicate e-mails on signup, who cares? Since you're not using them as an identifier, let multiple users have the same e-mail address.

Making your validation errors cross mediums and a wait for an e-mail to delivered is an unnecessarily hostile user experience.

Re: “Username or password is incorrect” is bullshit

#96

Post by StavrosK »

u801e wrote: post #63

Not quite on topic, but it would be nice if more websites would offer the option of using client side TLS certificate "login" with or without an additional prompt for a username and password. It would be next to impossible for an attacker to bypass that. For example, even if the attacker provided the correct credentials, they most likely would not have the associated client-side TLS certificate private key. Then the…

U2F does that. I wonder if sites could use the U2F token as the first factor and ask you to enter a password as the second factor (along with a "remember this computer" box for the password). Would make things much more convenient (unless you were on a device that didn't support U2F, I guess).

Re: “Username or password is incorrect” is bullshit

#97

Post by perfmode »

ryanbrunner wrote: post #91
pqh wrote: post #85

Earlier quoted context omitted.

default to privacy though, please

Not really. "Default to privacy" is what gives you insane useless UXes like the one in the article, where you're making login (already a frustrating experience) more painful with absolutely zero gain in security. Default to knowing your threat model. Default to balancing security concerns with UX, and make an informed decision instead of blindly following best practices.

I don’t want others to know all of the places where I have accounts.

That’s an easy way to be targeted.

Re: “Username or password is incorrect” is bullshit

#99

Post by RamenJunkie_ »

IanCal wrote: post #76
bo1024 wrote: post #57

Earlier quoted context omitted.

Why? I don't see why it's important to hide existence of a user unless you're allowing people to try multiple logins per second on your site. (I'm not an expert so I am sincerely asking to help me understand.)

Very quick examples, if I can check if an email address is registered on a site I can 1. Identify people who are gay/bi (e.g. signed up to grindr) 2. Identify political affiliations (depending on site) 3. Identify health issues (signed up to a mental health forum, or cancer support group, etc) These things people might be happy others knowing, but I hope you can at least see some cases where you might not.

You could also potentially build spam email lists too, to target users of that web site, if you automated some system that guessed emails addresses and filed away the ones that come back as registered.

Re: “Username or password is incorrect” is bullshit

#100

Post by travisjeffery »

ivanbakel wrote: post #92
pornel wrote: post #71

The right answer isn't a blanket "sites should do this super-secret e-mail-only shuffle and not tell you anything". First, you should define your threat model: which information is considered secret and which isn't, and treat any violations as security vulnerabilities. If usernames are public by design, then don't hide them in one form, and expose in URLs elsewhere on the site. If exposing who's registered on your si…

I'm not sure the point made was as much "use this blanket solution" as "if you're aiming to do this, go all the way". Obviously, Github and Stripe aren't actually enforcing these messages as part of some larger security policy, or if they are, they're doing it very poorly. But if they were, the email shuffle is what they ought to be doing.

You got it. You can be about security or UX. And when the accounts are public I'm especially in favor of taking advantage UX-wise. The issue's when both are half-assed.
Post reply on HN