41

I just noticed that when you

  1. go to https://stackoverflow.com/users/login#log-in
  2. pick "Stack Exchange"
  3. enter any email address
  4. submit the form without entering a password

you will get a message like "no account with this email address found". This kind of feedback could be used (IMHO) to launch an enumeration attack against the platform that would give the attacker a chance to identify registered accounts. I would propose to replace this behaviour by a validation message saying "Password must not be empty".

Improve this question
4
  • 1
    What happens if you enter a valid e-mail address with no password?
    – ChrisF Mod
    May 14, 2012 at 12:32
  • You get "Incorrect password" as the message.
    – Rob
    May 14, 2012 at 12:45
  • 5
    That's bad. (I just came back to say I'd checked).
    – ChrisF Mod
    May 14, 2012 at 12:46
  • 2
    IIRC, login attempts are rate-limited, which mitigates some of the concern here.
    – user154510
    May 14, 2012 at 16:56

2 Answers 2

Reset to default
20

I agree with the principle, generally, that indicating which aspect of the credentials is incorrect (the email or password) gives attackers a larger surface area to attack; if the system tells them that the password is wrong, they know that the email is valid. If the system tells them that the email doesn't exist, they won't expend resources on trying to attack passwords on that particular email.

However, I think that a different, more ambiguous message should be provided towards the above ends.

That said, a generic error should be given when either the username and/or password is incorrect. Something along the lines of:

We apologize, but the credentials provided (either the email and/or password) are incorrect.

And it would look like this (freehand circle omitted):

New login failed message

Improve this answer
5
  • 10
    I agreed with you up until ... freehand circle omitted
    – Matt
    May 14, 2012 at 12:51
  • 3
    @Matt The devs are still working on the algorithm to apply a new, random, generic freehand circle to any HTML element on a page. Until that's done, the freehand circle can't be added. Estimated time to completion, six to eight weeks
    – casperOne
    May 14, 2012 at 12:53
  • 16
    I vote to get rid of the "We apologize" - it doesn't matter how nice you think it is, there is nothing to apologize for.
    – slugster
    May 14, 2012 at 13:34
  • 4
    We apologize for the fault in the error messages. Those responsible have been sacked.
    – user7116
    May 14, 2012 at 17:21
  • 3
    Eschew unnecessary verbosity: "Sorry, incorrect email or password."
    – freiheit
    May 17, 2012 at 17:38
2

I tend to agree that some ambiguity might be prudent here, however it's important to consider that login and recovery attempts are heavily monitored and heavily rate limited by our front-end. It doesn't take more than a few unsuccessful attempts for the system to tell you that it's not accepting any more requests. It also doesn't say for how long, or even that it (is) a relatively short amount of time before it resets. That, alone, thwarts brute force / enumeration attacks, and it works very well.

In fact, most people that trigger such block don't realize that they signed in with Google or Facebook, and keep wondering why their email address isn't recognized. While we have improved it quite a bit, logging in to our site isn't the easiest thing to do for the non-technical, and our audience of non-technical folks is growing every day.

In my not-so-humble opinion, the whole way we handle this should probably change. It'd be really nice if the system could say "Are you sure you didn't mean to sign in with your Google / Yahoo / Facebook account?" if we've seen the email before, and then degrade to "email address or password was incorrect" (not hinting at which) if in fact we're certain they're trying to use an SE OpenID.

Put simply yes, this could be better, but I think we should go for a more holistic fix.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .