4 ms·

"An application should respond with a generic error message regardless of whether the user ID or password was incorrect." I really don't like this advice (alth

by beobab 12y ago

"An application should respond with a generic error message regardless of whether the user ID or password was incorrect." I really don't like this advice (although I see why they put it in there). I often use different email addresses for different services so that I can determine who sells on email addresses (depending on how much I trust them), and quite often I can't remember which email address I signed up with (was that mojang@...com or minecraft@...com). At least if I see "user not recognised", I know to try a different email address.

birdmanjeremy 12y ago
Agreed. I actually just fought and won this battle at work. If you don't want to expose the specific error when logging in, you must either not leak usernames/emails through the signup process either. Otherwise, it's just security theater.
- jfroma 12y ago
  Yes, and it is very hard to show a generic error during sign up. "There is an error with your data..." WHAT ERROR? I've typed 10 fields. I think a better approach is to rate limit wrong usernames / emails during sign in.
  - x1j7xJuzX 12y ago
    It's not a difficult problem to solve. Just let the sign-up succeed whether an account already exists for the email or not. Then say "You will receive an email with instructions to complete your registration". If there was no existing account, send an email with the text: "An account was created for this email address at Example.com. If you requested this account, you may activate it by clicking here: https://..." https://..." If there was an existing account, send: "An attempt was made to create a new account at Example.com for this email address, but you already have an account. If you have forgotten your password, visit https://..." https://..."
    - jdbernard 12y ago
      That works for sign-up, but not for the far more common case of sign-in.
      - birdmanjeremy 12y ago
        If you use this approach, the idea is then that you use a generic login failure message. This prevents leaking of any account information, but provides a different (poorer, IMO) user experience.
    - birdmanjeremy 12y ago
      Yes, this was the alternative we discussed. We opted to go with the simpler (and very common) signup process, which does admittedly leak some information.
  - birdmanjeremy 12y ago
    This is exactly the approach we took.
deleted 12y ago
[deleted]
jessaustin 12y ago
So just keep trying addresses until you get a reset link sent to you. It's really unacceptable for any service to leak its user list in the way you suggest. EDIT: x1j7xJuzX in the sibling subthread has it right for email addresses. It's true that separate usernames would be difficult to handle in a user-friendly manner without leaking, but with a valid email address a separate username is probably unnecessary. It doesn't help the user interact with the site. If users interact with each other, they can just choose non-unique display names. To prevent impersonation, just use display name plus some other invariant account property to generate a hash that is displayed alongside the display name.
- ryanatkn 12y ago
  Doesn't almost every service leak users at sign up? There are ways around it but I don't think they've very common.
- oneeyedpigeon 12y ago
  How do you avoid 'leaking the user list' if you enforce unique usernames?
  - sanderjd 12y ago
    If you use email as username, you can make the sign up give the same "check your email to confirm your account" message for a new account and an existing account. This works well for new users and those who have already signed up but perhaps forgot, and leaks no information to someone who doesn't have access to that email account. I'm not sure how to do this just for usernames, but usernames are less sensitive than emails anyway.
shogun21 12y ago
When registering for an account, duplicate usernames will flag a warning. This is enough to give hackers info whether or not a username exists.
danw3 12y ago
There was a decent article (I think it was on HN) a while ago that argued against this type of generic error message. The basic idea is that you can very easily discover whether the email is valid or not by attempting to create an account with that email (in most cases). It's trivially easy to either verify that the email you are trying to use is valid, or even build a database of valid email addresses to crack by attempting to create accounts. So why bother with generic error messages at all. It is not really buying you anything on the security end and it seems like it is sacrificing some usability.
- aug-riedinger 12y ago
  https://kev.inburke.com/kevin/invalid-username-or-password-useless/ https://kev.inburke.com/kevin/invalid-username-or-password-u... Could not agree more on this. Best practice should evolve within time and wiki should be updated!

by beobab 12y ago

birdmanjeremy 12y ago

Agreed. I actually just fought and won this battle at work. If you don't want to expose the specific error when logging in, you must either not leak usernames/emails through the signup process either. Otherwise, it's just security theater.

jfroma 12y ago
Yes, and it is very hard to show a generic error during sign up. "There is an error with your data..." WHAT ERROR? I've typed 10 fields. I think a better approach is to rate limit wrong usernames / emails during sign in.
- x1j7xJuzX 12y ago
  It's not a difficult problem to solve. Just let the sign-up succeed whether an account already exists for the email or not. Then say "You will receive an email with instructions to complete your registration". If there was no existing account, send an email with the text: "An account was created for this email address at Example.com. If you requested this account, you may activate it by clicking here: https://..." https://..." If there was an existing account, send: "An attempt was made to create a new account at Example.com for this email address, but you already have an account. If you have forgotten your password, visit https://..." https://..."
  - jdbernard 12y ago
    That works for sign-up, but not for the far more common case of sign-in.
    - birdmanjeremy 12y ago
      If you use this approach, the idea is then that you use a generic login failure message. This prevents leaking of any account information, but provides a different (poorer, IMO) user experience.
  - birdmanjeremy 12y ago
    Yes, this was the alternative we discussed. We opted to go with the simpler (and very common) signup process, which does admittedly leak some information.
- birdmanjeremy 12y ago
  This is exactly the approach we took.

deleted 12y ago

[deleted]

jessaustin 12y ago

So just keep trying addresses until you get a reset link sent to you. It's really unacceptable for any service to leak its user list in the way you suggest. EDIT: x1j7xJuzX in the sibling subthread has it right for email addresses. It's true that separate usernames would be difficult to handle in a user-friendly manner without leaking, but with a valid email address a separate username is probably unnecessary. It doesn't help the user interact with the site. If users interact with each other, they can just choose non-unique display names. To prevent impersonation, just use display name plus some other invariant account property to generate a hash that is displayed alongside the display name.

ryanatkn 12y ago
Doesn't almost every service leak users at sign up? There are ways around it but I don't think they've very common.
oneeyedpigeon 12y ago
How do you avoid 'leaking the user list' if you enforce unique usernames?
- sanderjd 12y ago
  If you use email as username, you can make the sign up give the same "check your email to confirm your account" message for a new account and an existing account. This works well for new users and those who have already signed up but perhaps forgot, and leaks no information to someone who doesn't have access to that email account. I'm not sure how to do this just for usernames, but usernames are less sensitive than emails anyway.

shogun21 12y ago

When registering for an account, duplicate usernames will flag a warning. This is enough to give hackers info whether or not a username exists.

danw3 12y ago

There was a decent article (I think it was on HN) a while ago that argued against this type of generic error message. The basic idea is that you can very easily discover whether the email is valid or not by attempting to create an account with that email (in most cases). It's trivially easy to either verify that the email you are trying to use is valid, or even build a database of valid email addresses to crack by attempting to create accounts. So why bother with generic error messages at all. It is not really buying you anything on the security end and it seems like it is sacrificing some usability.

aug-riedinger 12y ago
https://kev.inburke.com/kevin/invalid-username-or-password-useless/ https://kev.inburke.com/kevin/invalid-username-or-password-u... Could not agree more on this. Best practice should evolve within time and wiki should be updated!