Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Invalid username or password” is a useless security measure

kev.inburke.com

Post reply on HN
Print view View original

91–100 of 188 posts

Re: “Invalid username or password” is a useless security measure

#91

Post by TheLoneWolfling »

baddox wrote: post #45
cryptoz wrote: post #7

This doesn't address timing attacks, which are why this is done in the first place. If the code checks only for a username existing and returns the error message, this takes a measurably different amount of time compared to then also looking up if the password matches. The error shown isn't to dissuade people from using web pages to try to gain access to accounts - it's because the raw code itself doesn't know which…

I feel like the variance in network latency is going to be an orders of magnitude larger than the extra time it takes to test a password.

Doesn't matter.

Network latency variance just means you need to sample more. It doesn't prevent the attack.

Re: “Invalid username or password” is a useless security measure

#92

Post by spb »

Someone1234 wrote: post #66

> Consider throttling invalid login attempts by IP address or subnet. Oh hell no. First off that is completely ineffective. Botnets are common and inexpensive. But worse still a lot of users often share a single IP (e.g. university dorms, businesses, public wifi, etc). I agree with the first part of this article (i.e. that it is trivial to "prove" a username is valid, and that worse error responses aren't accomplishi…

> Set no maximum password length (250+ characters)

It's important to note that if you take the classical advice to "use bcrypt" (http://codahale.com/how-to-safely-store-a-password/), your password will be effectively truncated at 72 characters.

Re: “Invalid username or password” is a useless security measure

#93

Post by bluedino »

mbesto wrote: post #23

> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. That's terrible UX. > But there's a tradeoff there between security and UX, I hear you say. I am trying to show you there is no tradeoff; you are choosing between a better user experience and a worse use…

>> I didn't reach this conclusion at all. Am I missing something?

He's saying that letting the user know the password is wrong, and not the email address, is a better error message. Since an attacker can simply try to register a new account to check if an account exists.

Re: “Invalid username or password” is a useless security measure

#94

Post by ernesth »

Someone1234 wrote: post #66

> Consider throttling invalid login attempts by IP address or subnet. Oh hell no. First off that is completely ineffective. Botnets are common and inexpensive. But worse still a lot of users often share a single IP (e.g. university dorms, businesses, public wifi, etc). I agree with the first part of this article (i.e. that it is trivial to "prove" a username is valid, and that worse error responses aren't accomplishi…

>> Exponential backoff (forcing attackers to try again after 1, 2, 4, 8, 16.. seconds) is useful as well.

> Just open a spreadsheet and determine how long it would take to test 1500 passwords.

5.557 * 10^443 average Gregorian years.

Re: “Invalid username or password” is a useless security measure

#95

Post by tracker1 »

nanofortnight wrote: post #56
tracker1 wrote: post #21

Earlier quoted context omitted.

I don't see how what you say is really true in a system with properly hashed/salted passwords. SELECT "Id", "Hash", "Salt" FROM USERS WHERE "Email" = $input if (results.length == 0) return -1; //No record, bad user, return early... if (results["Hash"] != Hash(pwd.trim(), results["Salt"]) return -2; //invalid password

Your code has precisely the timing attack he tried to describe in it. You're returning early when a user doesn't exist.

So? I'm advocating showing the correct error message... a timing attack is irrelevant in this case.

For that matter, adding a random 500-2000ms timer before returning a failed result would likely be as effective, and not lead to a bad user experience.

Re: “Invalid username or password” is a useless security measure

#96

Post by andrewstuart2 »

crumpled wrote: post #71
andrewstuart2 wrote: post #51

I think the real lesson here is that if emails should remain secret you should not indicate upon signup whether or not a user exists with that email. Always send an email. If that user already exists, make sure the email says "We noticed you're trying to sign up again. If you didn't do this, someone else is trying to sign up for you." If that user doesn't exist, send them the typical signup message. The author has so…

Forcing the user to interact with an email client during the signup process before they've confirmed the availability of a username might be good for security, but it's a horrible way to gain users. That's a very high friction process. I generally agree with this comment, however.

Hmm, I do see your point, though I'd propose that usernames are more often than not public information. That's been my experience at least.

The difference for usernames is that they may or may not be shared across services. They're a bit more transient to the average user than an email is, though only a bit.

That said, it depends more on your use case than anything else. If any information is private information, it should remain private. Otherwise, I say make it easier to access that information, and be consistent.

To be fair to those implementing the example login systems as well, not all malicious attackers are hackers. It could be an angry ex who wouldn't necessarily think to try creating a new user before proceeding with their password-mashing attempts.

"Bad login combination" and variants do avoid information leakage. It's just not consistently enforced across all surface area. As another example, I believe Amazon public wishlists are searchable by email. That alone can net you an easy list of logins to brute force or check against existing email-password lists.

I think it's most likely that these services are avoiding the "that username exists but it's not actually yours" conundrum while keeping code (and UX) complexity to a minimum.

Re: “Invalid username or password” is a useless security measure

#97

Post by aprescott »

mikeryan wrote: post #27
tacostakohashi wrote: post #3

Leaving security aside, "incorrect username/password" is still the more correct and useful statement. Consider the case where you mistype your username (email). For sites like amazon, gmail, hotmail, yahoo, twitter, etc, it is entirely likely that the mistyped username is somebody else's valid username, you typed the password correctly, and "incorrect password" would hide the problem.

This seems like a messaging problem? "Password does not match our records for username/email XXX. Please check that both password and username are correct." Responding to below This reads to me like a more verbose version of "Incorrect username or password." Note this version is not wordsmithed and could probably be done better but the goal and inherent difference of this to the original is to let the user know that…

This reads to me like a more verbose version of "Incorrect username or password." I'd favour the shorter version that gets the same point across.

Re: “Invalid username or password” is a useless security measure

#98

Post by biot »

baddox wrote: post #45
cryptoz wrote: post #7

This doesn't address timing attacks, which are why this is done in the first place. If the code checks only for a username existing and returns the error message, this takes a measurably different amount of time compared to then also looking up if the password matches. The error shown isn't to dissuade people from using web pages to try to gain access to accounts - it's because the raw code itself doesn't know which…

I feel like the variance in network latency is going to be an orders of magnitude larger than the extra time it takes to test a password.

It is, but with a sufficiently large number of attempts you can account for jitter. A good summary (with links to existing research) can be found here:

http://blog.astrumfutura.com/2010/10/nanosecond-scale-remote...

Re: “Invalid username or password” is a useless security measure

#99

Post by phantom784 »

slg wrote: post #61
andrewstuart2 wrote: post #51

I think the real lesson here is that if emails should remain secret you should not indicate upon signup whether or not a user exists with that email. Always send an email. If that user already exists, make sure the email says "We noticed you're trying to sign up again. If you didn't do this, someone else is trying to sign up for you." If that user doesn't exist, send them the typical signup message. The author has so…

Security is all about trade-offs. Sending emails puts a bigger barrier between signup and first sign in. It is probably a better business move to slightly inconvenience some existing customers rather than slightly inconvenience all potential new customers.

It's already pretty common to require clicking a verification link in an email to complete registration. If you're using someone else's email on the registration page, you're already doing something fishy, and this prevents you from discovering that the email is already in-use. To a legit user, everything looks normal (and to a legit user who forgot they had an account, they'll get a simple reminder in their inbox when they look for their validation link, possibly with forgot password instructions included).

Of course, this all goes out the window if you're not using emails as usernames.

Re: “Invalid username or password” is a useless security measure

#100

Post by fmx »

0xffff2 wrote: post #6

Even simpler than trying to sign up for a new account, many sites will tell you if you enter an unregistered email on their "forgot password" page.

Some sites don't. They instead say "if an account with that email address exists we've sent you an email with the reset link". That seems like a nice touch, but it's pointless if you can still find out that a given email address is a registered user in some other way (such as by trying to sign up with it). So it's just another variant of the "invalid username/password" message.
Post reply on HN