4 ms·
I have some problems with this. 1) It's unfamiliar, and this will slow people down. While this is not a major issue, compared to the rest, it may certainly in
by DanHulton 16y ago
I have some problems with this.
1) It's unfamiliar, and this will slow people down. While this is not a major issue, compared to the rest, it may certainly increase support costs, which may not be allowable if you're working on Enterprise software with a huge userbase.
2) It would require a nonstandard UI widget in order to display the username in cleartext while hiding the password in the same field. If you're designing for the web, this means you're messing with people on mobile devices, which are a fast-growing segment of the population.
3) If space is the delimiter for username/password, it means that you can't use space in your username. I HATE when you can't use space in your username and possibly in your password, depending upon on how well-designed and well-followed your spec is and becomes. For one, I prefer having my username as "Dan Hulton", not "DanHulton", though that's a minor quibble. More importantly, more entropy is more better, and allowing people to use spaces in their usernames/passwords encourages the use of passphrases, which are LEAGUES better than passwords.
Also, having separate warnings for your username and password matches is a bad security practice. Best to just say "username/password combination not found" instead of letting a potential hacker know he's stumbled upon a valid username.
- benjoffe 16y ago> Also, having separate warnings for your username and password matches is a bad security practice. Best to just say "username/password combination not found" instead of letting a potential hacker know he's stumbled upon a valid username. I don't see why that's generally going to be a security flaw; most services already indicate if a username is taken when signing up so a hacker can poll for random names there instead.
- johnwatson11218 16y agoDoes everyone agree about that last point? That having a single error message that says "username/password combo not found" is more secure? I have always thought that the username was not secret and to treat it as part of the secret is almost like saying there is no username just a big password that you enter in two distinct boxes. I understand that hackers do like ways to validate that they have an actual username and aren't just guessing ... it is like having the first half of the 'big secret password' cracked. I am throwing this out there because I think it is important to know which pieces of your security model are 'load bearing' so to speak. I'm not really comfortable with this quasi secret status that the username enjoys. I think it is either a secret or it is public info.
- fhars 16y agoYes, it is. You should design your login system assuming that the username is public, of course (otherwise you would facilitate attacks targetet at a specific user), but for an attack on the site itself that needs just any one account, separate error messages reduce the complexity by several orders of magnitude. Assume 8 characters out of A-Za-z0-9 for the username and 8 character out of 96 printable chars for the password. With a single error message, the search space is 62^8 times 96^8, with separate error messages it is 62^8+n times 96^8, with n being the number of users. This is far, far smaller if the number of users is noticably less then 62^8. [edit: stupid comment parser ate math symbols]
- epochwolf 16y agoThis doesn't work very well if your password reset screen gives errors if the user doesn't exist. Or you can look up users by a given url. (deviantArt.com gives each user a subdomain that is the same as their username, easy lookup)
- aquark 16y agoI understand the security argument about not giving out more information than you absolutely need to. But, I hate 'low-risk' sites that do this when I'm not sure of my username/password. If I can't remember what username I used 6 months ago when I signed up then at least tell me I got that wrong instead of trying different passwords. Even better, scratch usernames and let me log in with my email address.