5 ms·

Does everyone agree about that last point? That having a single error message that says "username/password combo not found" is more secure? I have always though

Does everyone agree about that last point? That having a single error message that says "username/password combo not found" is more secure? I have always thought that the username was not secret and to treat it as part of the secret is almost like saying there is no username just a big password that you enter in two distinct boxes. I understand that hackers do like ways to validate that they have an actual username and aren't just guessing ... it is like having the first half of the 'big secret password' cracked. I am throwing this out there because I think it is important to know which pieces of your security model are 'load bearing' so to speak. I'm not really comfortable with this quasi secret status that the username enjoys. I think it is either a secret or it is public info.

fhars 16y ago
Yes, it is. You should design your login system assuming that the username is public, of course (otherwise you would facilitate attacks targetet at a specific user), but for an attack on the site itself that needs just any one account, separate error messages reduce the complexity by several orders of magnitude. Assume 8 characters out of A-Za-z0-9 for the username and 8 character out of 96 printable chars for the password. With a single error message, the search space is 62^8 times 96^8, with separate error messages it is 62^8+n times 96^8, with n being the number of users. This is far, far smaller if the number of users is noticably less then 62^8. [edit: stupid comment parser ate math symbols]
- epochwolf 16y ago
  This doesn't work very well if your password reset screen gives errors if the user doesn't exist. Or you can look up users by a given url. (deviantArt.com gives each user a subdomain that is the same as their username, easy lookup)
aquark 16y ago
I understand the security argument about not giving out more information than you absolutely need to. But, I hate 'low-risk' sites that do this when I'm not sure of my username/password. If I can't remember what username I used 6 months ago when I signed up then at least tell me I got that wrong instead of trying different passwords. Even better, scratch usernames and let me log in with my email address.
- techbio 16y ago
  This.
  - Groxx 16y ago
    "This." == clicking the up-arrow.
    - techbio 16y ago
      TY, but it was meant with a tone of finality the up arrow lacks.
      - Groxx 16y ago
        If that is the case, it probably deserve(s|d) a reason for support. "This." contains zero content aside from approval - functionally identical to the arrow, but at a much higher waste for everyone who encounters it.
        techbio 16y ago
        OK! OK I get it already. Sorry I like simplicity when I'm not dealing with my banking and medical records.

fhars 16y ago

Yes, it is. You should design your login system assuming that the username is public, of course (otherwise you would facilitate attacks targetet at a specific user), but for an attack on the site itself that needs just any one account, separate error messages reduce the complexity by several orders of magnitude. Assume 8 characters out of A-Za-z0-9 for the username and 8 character out of 96 printable chars for the password. With a single error message, the search space is 62^8 times 96^8, with separate error messages it is 62^8+n times 96^8, with n being the number of users. This is far, far smaller if the number of users is noticably less then 62^8. [edit: stupid comment parser ate math symbols]

epochwolf 16y ago
This doesn't work very well if your password reset screen gives errors if the user doesn't exist. Or you can look up users by a given url. (deviantArt.com gives each user a subdomain that is the same as their username, easy lookup)

aquark 16y ago

I understand the security argument about not giving out more information than you absolutely need to. But, I hate 'low-risk' sites that do this when I'm not sure of my username/password. If I can't remember what username I used 6 months ago when I signed up then at least tell me I got that wrong instead of trying different passwords. Even better, scratch usernames and let me log in with my email address.

techbio 16y ago
This.
- Groxx 16y ago
  "This." == clicking the up-arrow.
  - techbio 16y ago
    TY, but it was meant with a tone of finality the up arrow lacks.
    - Groxx 16y ago
      If that is the case, it probably deserve(s|d) a reason for support. "This." contains zero content aside from approval - functionally identical to the arrow, but at a much higher waste for everyone who encounters it.
      - techbio 16y ago
        OK! OK I get it already. Sorry I like simplicity when I'm not dealing with my banking and medical records.