4 ms·
After reading this I deleted my lastpass account and came across this message upon trying to log in. http://imgur.com/a/SFpWw http://imgur.com/a/SFpWw One of
by milkytron 10y ago
After reading this I deleted my lastpass account and came across this message upon trying to log in.
http://imgur.com/a/SFpWw http://imgur.com/a/SFpWw
One of the first things I learned about security was not to tell the user which credential was incorrect.
Disclaimer: I'm not a security expert.
- emodendroket 10y agoI mean, honestly, it's not a crazy trade-off to let people see the username, especially if you have a registration page that's going to tell people "sorry, that name is already registered."
- jerf 10y agoThe debate that the smart people have on that one still seems to go back and forth. I can find people I respect who have both opinions. My only contribution is that I suspect that in practice almost every site leaks this info if you try hard enough, via some form of timing attack. You can get off-the-shelf "constant time string comparison" algorithms, but it's impractical to write anything much larger in a constant-time fashion, certainly nothing as complicated as a full authentication flow, especially in the light of the complexity of the systems we program on nowadays, with so many layers of caching to exploit for timing, etc. I've leaned in the direction of going for the user-friendly approach in my code, though I've only come around to that recently.