What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 127 Stack Exchange communities.

I just noticed that when you

  1. go to http://stackoverflow.com/users/login#log-in
  2. pick "Stack Exchange"
  3. enter any email address
  4. submit the form without entering a password

you will get a message like "no account with this email address found". This kind of feedback could be used (IMHO) to launch an enumeration attack against the platform that would give the attacker a chance to identify registered accounts. I would propose to replace this behaviour by a validation message saying "Password must not be empty".

share|improve this question
What happens if you enter a valid e-mail address with no password? –  ChrisF May 14 '12 at 12:32
You get "Incorrect password" as the message. –  Rob May 14 '12 at 12:45
That's bad. (I just came back to say I'd checked). –  ChrisF May 14 '12 at 12:46
IIRC, login attempts are rate-limited, which mitigates some of the concern here. –  Matthew Read May 14 '12 at 16:56
add comment

1 Answer

up vote 18 down vote accepted

I agree with the principle, generally, that indicating which aspect of the credentials is incorrect (the email or password) gives attackers a larger surface area to attack; if the system tells them that the password is wrong, they know that the email is valid. If the system tells them that the email doesn't exist, they won't expend resources on trying to attack passwords on that particular email.

However, I think that a different, more ambiguous message should be provided towards the above ends.

That said, a generic error should be given when either the username and/or password is incorrect. Something along the lines of:

We apologize, but the credentials provided (either the email and/or password) are incorrect.

And it would look like this (freehand circle omitted):

New login failed message

share|improve this answer
I agreed with you up until ... freehand circle omitted –  Matt May 14 '12 at 12:51
@Matt The devs are still working on the algorithm to apply a new, random, generic freehand circle to any HTML element on a page. Until that's done, the freehand circle can't be added. Estimated time to completion, six to eight weeks –  casperOne May 14 '12 at 12:53
I vote to get rid of the "We apologize" - it doesn't matter how nice you think it is, there is nothing to apologize for. –  slugster May 14 '12 at 13:34
We apologize for the fault in the error messages. Those responsible have been sacked. –  user7116 May 14 '12 at 17:21
ow my balls... youtube.com/watch?v=r_4jrMwvZ2A –  Nathan Koop May 16 '12 at 18:25
Eschew unnecessary verbosity: "Sorry, incorrect email or password." –  freiheit May 17 '12 at 17:38
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .