5 ms·
> Our old login form told users, "Your username or password is incorrect," when they may have the username right, but the password was incorrect. If you have 4
by makmanalp 12y ago
> Our old login form told users, "Your username or password is incorrect," when they may have the username right, but the password was incorrect. If you have 4 possible usernames and 4 possible passwords, you have 16 possible combinations between them—only one of which is correct. That means in this scenario, the user would have 15 chances to make an error when logging in. But when you know specifically that your username is incorrect, odds of failure drop precipitously.Our old login form told users, "Your username or password is incorrect," when they may have the username right, but the password was incorrect. If you have 4 possible usernames and 4 possible passwords, you have 16 possible combinations between them—only one of which is correct. That means in this scenario, the user would have 15 chances to make an error when logging in. But when you know specifically that your username is incorrect, odds of failure drop precipitously.
This is an old pattern. The reason for it seems to have been forgotten: If you tell the user they got the user name wrong, you're leaking information. They can now try and guess valid account names. Of course, one could argue that this may not matter in their specific case, but it does in some.
The parable of chesterton's fence comes to mind: http://en.wikipedia.org/wiki/Wikipedia:Chesterton%27s_fence http://en.wikipedia.org/wiki/Wikipedia:Chesterton%27s_fence
edit: Ah, I really need to overcome that instinct of jumping to the comments whenever I notice something. Looks like they addressed this.
- notatoad 12y agothe reason for it is specifically addressed in the article... "But after some further consideration, we decided that it was a false risk, as the username reminder form already tells you if a username exists"
- giovannibajo1 12y agoFor usernames it might be true but many sites use emails instead of usernames (and rightfully so, it's already complicated for people to remember passwords without forcing them to also remember an unique username). Emails are more personal and might be easier to link back to personal information. Thus, confirming that there is an associated account with a given email is also a privacy leak, because maybe people don't want to reveal that they have an account on a specific website.
- madeofpalk 12y agoBut don't you leak the same information during registration? What happens when a user tries to sign up with an already existing email address? Don't you return an error saying that email has already been used?
- ams6110 12y agoThis actually argues in favor of only using social logins, which would not leak any clues about other users of the site.
- madeofpalk 12y agoOh, I wasn't arguing either way. Personally I prefer social login, but I have no strong conviction either way.
- Rapzid 12y agoYou could just email them a link to finalize registration. If it has already been used include that information in the email.
- vacri 12y agoemail addressess are frequently public information anyway, and often get leaked through other methods like giant CC list emails. Unless you have a specific reason to conceal email addresses, I'd argue that the cost of keeping that tiny nugget of information secret is too high for the level of security it adds. And as they say in the article, that information is already leaked by the password reset process: "No email by that name available".
- GrinningFool 12y agoWould the argument then be to change the password reset process to something like, "After we verify that this address exists in our records, a password reset email will be sent to it."
- Rapzid 12y agoSo the risk on that specific page is false then? The risk itself isn't false just because the information is leaked elsewhere..
- abuddy 12y agoWhen you create an account and the username already exists, the website tells you that. How is this difficult for someone to do this instead of guessing the username on the login page? It's the same.
- wtracz 12y agoIt's more pervasive than just registration too if you allow the username to be adjusted. This is again a problem with email addresses that also allows leakage. Regarding the probability of attack, people should monitor the number of different usernames attempted by a session/IP not just failed attempts against individual accounts. Otherwise it is very easy to try thousands of username combinations with a selected weak password.
- deleted 12y ago[deleted]