5 ms·

But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will

But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct. The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.

comprev 4y ago
- kuschku 4y ago
  Again, how is that leakage, if you can just try registering a new account and see if that username or email already exists?
  - duxup 4y ago
    Do most people who are throwing usernames and passwords at websites ... do that?
    - michaelt 4y ago
      If they could benefit from the 'information leakage' of knowing a username exists, they would do. If they don't - then maybe this 'information leakage' worry is obsolete security advice. There's loads of obsolete security advice around. (of course there might be other, non-account-security-related reasons to make it impossible to know if an account exists. It's one thing if HN's login form reveals that user duxup exists, it's another if find-an-affair-partner.com reveals the same thing)
      - duxup 4y ago
        >There's loads of obsolete security advice around. Yeah that's kinda what I'm wondering about. It's possible that most of your security issues are just folks credential stuffing in the simplest way, if that's the case then the whole registration thing isn't really a realistic concern. Hell when I was in networking and if you did your best to just block traffic to / from specific regions / nations ... you eliminated a huge % of malicious traffic. For the guy thinking deeply about security that seems odd / not specific enough, but in the real world it works...
      - Dylan16807 4y ago
        There's another option, where trying to sign up takes more effort than trying to log in and leaves bigger red flags, so they won't use that method.
  - cybrox 4y ago
    ... which is a fixable leakage as well, as discussed in other threads in this discussion. Neither login nor sing up form should tell you that the account already exists.
- joosters 4y ago
  True, but the story covers that aspect - many systems provide other ways to check if a username exists (e.g. trying to register a new account, or sending an email to a gmail address, and so on)
- maxpro 4y ago
- david422 4y ago
  The article literally tells how the username can already be validated.
  - Supermancho 4y ago
    > The article literally tells how the username can already be validated. The article says how many websites can allow that. This has nothing to do with the theory. This identifies poor implementations. These implementations trade reducing friction in signups, for some user security. There's nothing wrong with "Invalid Username or Password" (eg ssh, et al), unless the security mechanism is self-sabotaged.
- capableweb 4y ago
  This is mentioned in the submission. The argument is as follows: If you're vague on the login page but still do the validation on the signup page, the information leakage happens regardless, just on the signup page rather than login, as most websites only allow one account per email.
  - Xylakant 4y ago
    “If you’re trying to prevent this information leakage, you also need to consider the following things” would be a much better conclusion to arrive at. Services that considered that problem just let you sign up twice and send you an email saying “you already seem to have an account.” As a positive side effect, this also notifies the account owner.
  - tluyben2 4y ago
    I just finish the registration process as normal but email the email that someone is trying to sign up again and if it is them. The user who signs up won’t notice anything.
  - calibas 4y ago
    That's a good argument for not letting the signup page leak information.
- deleted 4y ago
  [deleted]
- amelius 4y ago
  If you just say "invalid username+password combination", then you can have both security and a correct message.
- realgeniushere 4y ago
  You could have bothered to read the article before posting the most obvious, dismissive thing.
- ARandumGuy 4y ago
  How big of an issue is it to leak this information? Disregarding the fact that many sites easily leak this info, how much security is actually gained by obfuscating what usernames are taken? It seems to me like two factor authentication, rate limiting logins, good password rules, and properly securing passwords provide much better security then obfuscating usernames. There's always a balance between security and usability. I don't think hiding username availability provides enough security to justify the harm in the user experience.
prmph 4y ago
> If you mistype your username, you might have entered another, existing username. That's a good point, but there is no way the website can detect that situation, and I suspect it is much less likely than typing your correct username and the wrong password. > The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse. If the website doesn't know which one you got wrong, then yes, it should just tell you so; the article is not arguing otherwise.
- dheera 4y ago
  > there is no way the website can detect that situation Why? The website can salt, hash, match your password against all the hashed passwords for all the closest usernames within a certain edit distance. Not saying this is a good idea security-wise, but it's not impossible.
  - prmph 4y ago
    Apart from the security issues you've yourself noted, it's possible that the entered password matches another account's password coincidentally, not because the user intended to log in to that account.
    - Dylan16807 4y ago
      If your account has the same password as another account that's 1 or 2 letters different, it's not really the site's job to protect you. You screwed up. This is not a very big problem security-wise. It makes online attacks slightly easier, but you can limit online attempts pretty easily. It doesn't affect offline attempts at all. The downvotes dheera got are extra inappropriate because they were just saying it's doable.
  - yarg 4y ago
    It's also a terrible idea from a performance standpoint.
herendin2 4y ago
You can provide a more helpful error message by explicitly informing the user that the username they typed exists but they haven't offered the correct password for it. Unless the site searches to find out which username the entered password actually corresponds to (which is a whole new, terribly dangerous, can of worms), it can't do better than that Because any malicious player can easily check whether usernames exist, so hiding that data point is not much good for security.
- capableweb 4y ago
  It doesn't seem like the author is arguing that just because you can instead validate if the email exists on a platform via the signup page instead of the login page, the vague message can be removed, but rather that the signup page should remove the information leakage as well, so there is no leakage anywhere.
  - michaelmior 4y ago
    That was presented as an option, but explicitly not recommended. > …you can make the signup process email based.…I don't recommend this, because of the context switches, though you can implement it.
    - Xylakant 4y ago
      practically all website that use an email as username nowadays require email confirmation, so already include the context switch. Because in the end, sending an email is the only way to verify that the email address is correct and you don't want an incorrect email address in your database if you rely on that communication channel. Now, if you have accounts in places where email addresses are not required and usernames take the place, the calculus may change. But using the context switch as an argument here is just weak.
  - selykg 4y ago
    Depending on your particular service, there's a better alternative for not leaking the existing account. A service I worked on previously was super sensitive and we didn't want to leak the existence of an existing account. What we did instead was asked for the email on the first page of signup, we verified the email was active by sending an email and a link to continue signup. If they already have an account we'd inform them in that email that they already have an account. This way, the attacker actually has to have access to the email in question to know that an existing account is present on the service. If you do the whole signup process on a single page and validate the email there then yea, you're gonna have a rough time.
bombcar 4y ago
I remember some system on the coding horrors site or similar that would tell you “password already used” if anyone had it. That could allow “bad username” if you got the password right!

comprev 4y ago

kuschku 4y ago
Again, how is that leakage, if you can just try registering a new account and see if that username or email already exists?
- duxup 4y ago
  Do most people who are throwing usernames and passwords at websites ... do that?
  - michaelt 4y ago
    If they could benefit from the 'information leakage' of knowing a username exists, they would do. If they don't - then maybe this 'information leakage' worry is obsolete security advice. There's loads of obsolete security advice around. (of course there might be other, non-account-security-related reasons to make it impossible to know if an account exists. It's one thing if HN's login form reveals that user duxup exists, it's another if find-an-affair-partner.com reveals the same thing)
    - duxup 4y ago
      >There's loads of obsolete security advice around. Yeah that's kinda what I'm wondering about. It's possible that most of your security issues are just folks credential stuffing in the simplest way, if that's the case then the whole registration thing isn't really a realistic concern. Hell when I was in networking and if you did your best to just block traffic to / from specific regions / nations ... you eliminated a huge % of malicious traffic. For the guy thinking deeply about security that seems odd / not specific enough, but in the real world it works...
    - Dylan16807 4y ago
      There's another option, where trying to sign up takes more effort than trying to log in and leaves bigger red flags, so they won't use that method.
- cybrox 4y ago
  ... which is a fixable leakage as well, as discussed in other threads in this discussion. Neither login nor sing up form should tell you that the account already exists.
joosters 4y ago
True, but the story covers that aspect - many systems provide other ways to check if a username exists (e.g. trying to register a new account, or sending an email to a gmail address, and so on)
maxpro 4y ago
david422 4y ago
The article literally tells how the username can already be validated.
- Supermancho 4y ago
  > The article literally tells how the username can already be validated. The article says how many websites can allow that. This has nothing to do with the theory. This identifies poor implementations. These implementations trade reducing friction in signups, for some user security. There's nothing wrong with "Invalid Username or Password" (eg ssh, et al), unless the security mechanism is self-sabotaged.
capableweb 4y ago
This is mentioned in the submission. The argument is as follows: If you're vague on the login page but still do the validation on the signup page, the information leakage happens regardless, just on the signup page rather than login, as most websites only allow one account per email.
- Xylakant 4y ago
  “If you’re trying to prevent this information leakage, you also need to consider the following things” would be a much better conclusion to arrive at. Services that considered that problem just let you sign up twice and send you an email saying “you already seem to have an account.” As a positive side effect, this also notifies the account owner.
- tluyben2 4y ago
  I just finish the registration process as normal but email the email that someone is trying to sign up again and if it is them. The user who signs up won’t notice anything.
- calibas 4y ago
  That's a good argument for not letting the signup page leak information.
deleted 4y ago
[deleted]
amelius 4y ago
If you just say "invalid username+password combination", then you can have both security and a correct message.
realgeniushere 4y ago
You could have bothered to read the article before posting the most obvious, dismissive thing.
ARandumGuy 4y ago
How big of an issue is it to leak this information? Disregarding the fact that many sites easily leak this info, how much security is actually gained by obfuscating what usernames are taken? It seems to me like two factor authentication, rate limiting logins, good password rules, and properly securing passwords provide much better security then obfuscating usernames. There's always a balance between security and usability. I don't think hiding username availability provides enough security to justify the harm in the user experience.

prmph 4y ago

> If you mistype your username, you might have entered another, existing username. That's a good point, but there is no way the website can detect that situation, and I suspect it is much less likely than typing your correct username and the wrong password. > The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse. If the website doesn't know which one you got wrong, then yes, it should just tell you so; the article is not arguing otherwise.

dheera 4y ago
> there is no way the website can detect that situation Why? The website can salt, hash, match your password against all the hashed passwords for all the closest usernames within a certain edit distance. Not saying this is a good idea security-wise, but it's not impossible.
- prmph 4y ago
  Apart from the security issues you've yourself noted, it's possible that the entered password matches another account's password coincidentally, not because the user intended to log in to that account.
  - Dylan16807 4y ago
    If your account has the same password as another account that's 1 or 2 letters different, it's not really the site's job to protect you. You screwed up. This is not a very big problem security-wise. It makes online attacks slightly easier, but you can limit online attempts pretty easily. It doesn't affect offline attempts at all. The downvotes dheera got are extra inappropriate because they were just saying it's doable.
- yarg 4y ago
  It's also a terrible idea from a performance standpoint.

herendin2 4y ago

You can provide a more helpful error message by explicitly informing the user that the username they typed exists but they haven't offered the correct password for it. Unless the site searches to find out which username the entered password actually corresponds to (which is a whole new, terribly dangerous, can of worms), it can't do better than that Because any malicious player can easily check whether usernames exist, so hiding that data point is not much good for security.

capableweb 4y ago
It doesn't seem like the author is arguing that just because you can instead validate if the email exists on a platform via the signup page instead of the login page, the vague message can be removed, but rather that the signup page should remove the information leakage as well, so there is no leakage anywhere.
- michaelmior 4y ago
  That was presented as an option, but explicitly not recommended. > …you can make the signup process email based.…I don't recommend this, because of the context switches, though you can implement it.
  - Xylakant 4y ago
    practically all website that use an email as username nowadays require email confirmation, so already include the context switch. Because in the end, sending an email is the only way to verify that the email address is correct and you don't want an incorrect email address in your database if you rely on that communication channel. Now, if you have accounts in places where email addresses are not required and usernames take the place, the calculus may change. But using the context switch as an argument here is just weak.
- selykg 4y ago
  Depending on your particular service, there's a better alternative for not leaking the existing account. A service I worked on previously was super sensitive and we didn't want to leak the existence of an existing account. What we did instead was asked for the email on the first page of signup, we verified the email was active by sending an email and a link to continue signup. If they already have an account we'd inform them in that email that they already have an account. This way, the attacker actually has to have access to the email in question to know that an existing account is present on the service. If you do the whole signup process on a single page and validate the email there then yea, you're gonna have a rough time.

bombcar 4y ago

I remember some system on the coding horrors site or similar that would tell you “password already used” if anyone had it. That could allow “bad username” if you got the password right!