6 ms·

“username or password incorrect” is bullshit

30 points by 0xmohit 6y ago

LorenPechtel 6y ago
Good point. I think this is a case of cargo cult programming--it makes good sense in situations where you can't just sign up but as he shows it's meaningless in situations where you can. The standard was laid down before the world became full of sites where you can simply create an account for free.
high_byte 6y ago
finally someone saying what we're all thinking! just tell me which one is wrong dammit!!
yumraj 6y ago
I think there is a fundamental error in this post. If there were targeted attack against a person sure, but IMHO this protects against simple brute force attack on the login page where the script just cycles through logins, finds a valid login, and then cycles through common passwords. If the argument is that the attack scripts can also run against the registration page to correlate login, sure, but you've just made the life harder for the attacker.
scyzoryk_xyz 6y ago
Not all security threats possible are from mr. robot episodes and involve sophisticated hackers. There are also a lot of straight up dumb people out there with malicious intentions. This method is more like a speed bump.
callesgg 6y ago
Mabye i don't want people beeing able to figure out that i have an account for a specific service. Well I guess they can figure that one out by signing up with my email. Cause when you do that websites tend to complain(I think). But given my previous statement I guess I think that would be the flaw if anything should be seen as a flaw.
nelgaard 6y ago
I agree. I must have wasted weeks of my life trying to get access to systems that just would not tell me what went wrong. Often just returning a 400 error code. Or given the "username or password incorrect" message even it not true. It is even worse when you are developing the client or trying to access a new server. It could be a wrong user name. Or I should have used my email instead of the user name or the other way around. or the password or it could be that the account is expired or an expired certificate or maybe some negotiation of encryption codecs failed or an URL is wrong. or maybe the server-side DB was down. once it turned out to be a REST API that stopped accepting single-quoted strings generated by a client. Then you click the "I forgot my password button" and nothing happens. You do not know if an email was sent. Or if an email was sent, to which email address is was sent. Or if it was stopped by a spam filter.
yongjik 6y ago
So, given a pair (username, password) that doesn't match the DB, the OP wants the system to magically figure out which one is wrong? What if the user typed a wrong username that matches another existing user?
- watermelon0 6y ago
  To my understanding, OP just wants websites to not expose any information (existing usernames and emails) to visitors, even in registration forms. What you suggest shouldn't be possible because: - multiple users can have the same password - properly hashed passwords rely on per-user/per-hash random seed, which can be only determined after user is found in the database
eyelidlessness 6y ago
There’s a pretty trivial way to fix this, if you’re willing to block post-signup access until the email is verified: 1. Make the signup look like it was successful. 2. Tell the user to check their email. 3. If the account already exists, send an optional password reset email to the account owner (tailored to explain what happened if you prefer, throttled to prevent spam/abuse as you see fit). 4. If you want to go the extra mile, check for password reuse and make the password reset mandatory, or at least strongly encourage it in the email.
miccah 6y ago
The vulnerability lies in the registration page disclosing that information. To show absolutely no signs, you would accept the registration with a message: "An email has been sent to the provided address." Obviously this is less convenient and arguably not a critical vulnerability for GitHub. The good news is, the registration page doesn't disclose which account an email address is associated with.
pjerem 6y ago
While usernames are easy to figure out, I think email divulgation should be taken more seriously. Even a registration form should not inform you that the email is already used. This information could be given ... by sending a mail. While disclosure of the existence of an account with your email have minimal impact on Stripe or GitHub, what about a dating site ? What about a politic website ? How about some sensible professional tool ?
tardyp 6y ago
Well.. Could be there right password but the account is misspelled...
Tepix 6y ago
This looked familiar and indeed the post is from 2017

30 points by 0xmohit 6y ago

Good point. I think this is a case of cargo cult programming--it makes good sense in situations where you can't just sign up but as he shows it's meaningless in situations where you can. The standard was laid down before the world became full of sites where you can simply create an account for free.

high_byte 6y ago

finally someone saying what we're all thinking! just tell me which one is wrong dammit!!

yumraj 6y ago

I think there is a fundamental error in this post. If there were targeted attack against a person sure, but IMHO this protects against simple brute force attack on the login page where the script just cycles through logins, finds a valid login, and then cycles through common passwords. If the argument is that the attack scripts can also run against the registration page to correlate login, sure, but you've just made the life harder for the attacker.

scyzoryk_xyz 6y ago

Not all security threats possible are from mr. robot episodes and involve sophisticated hackers. There are also a lot of straight up dumb people out there with malicious intentions. This method is more like a speed bump.

callesgg 6y ago

Mabye i don't want people beeing able to figure out that i have an account for a specific service. Well I guess they can figure that one out by signing up with my email. Cause when you do that websites tend to complain(I think). But given my previous statement I guess I think that would be the flaw if anything should be seen as a flaw.

nelgaard 6y ago

I agree. I must have wasted weeks of my life trying to get access to systems that just would not tell me what went wrong. Often just returning a 400 error code. Or given the "username or password incorrect" message even it not true. It is even worse when you are developing the client or trying to access a new server. It could be a wrong user name. Or I should have used my email instead of the user name or the other way around. or the password or it could be that the account is expired or an expired certificate or maybe some negotiation of encryption codecs failed or an URL is wrong. or maybe the server-side DB was down. once it turned out to be a REST API that stopped accepting single-quoted strings generated by a client. Then you click the "I forgot my password button" and nothing happens. You do not know if an email was sent. Or if an email was sent, to which email address is was sent. Or if it was stopped by a spam filter.

yongjik 6y ago

So, given a pair (username, password) that doesn't match the DB, the OP wants the system to magically figure out which one is wrong? What if the user typed a wrong username that matches another existing user?

watermelon0 6y ago
To my understanding, OP just wants websites to not expose any information (existing usernames and emails) to visitors, even in registration forms. What you suggest shouldn't be possible because: - multiple users can have the same password - properly hashed passwords rely on per-user/per-hash random seed, which can be only determined after user is found in the database

eyelidlessness 6y ago

There’s a pretty trivial way to fix this, if you’re willing to block post-signup access until the email is verified: 1. Make the signup look like it was successful. 2. Tell the user to check their email. 3. If the account already exists, send an optional password reset email to the account owner (tailored to explain what happened if you prefer, throttled to prevent spam/abuse as you see fit). 4. If you want to go the extra mile, check for password reuse and make the password reset mandatory, or at least strongly encourage it in the email.

miccah 6y ago

The vulnerability lies in the registration page disclosing that information. To show absolutely no signs, you would accept the registration with a message: "An email has been sent to the provided address." Obviously this is less convenient and arguably not a critical vulnerability for GitHub. The good news is, the registration page doesn't disclose which account an email address is associated with.

pjerem 6y ago

While usernames are easy to figure out, I think email divulgation should be taken more seriously. Even a registration form should not inform you that the email is already used. This information could be given ... by sending a mail. While disclosure of the existence of an account with your email have minimal impact on Stripe or GitHub, what about a dating site ? What about a politic website ? How about some sensible professional tool ?

tardyp 6y ago

Well.. Could be there right password but the account is misspelled...

Tepix 6y ago

This looked familiar and indeed the post is from 2017