I don't think it's safe or even good practice to tell a user specifically what part of my authentication credentials is faulty. I practically guessed my way to my correct username because SO let me know that the username portion of my credentials was incorrect. Then I moved to my password and I guessed my way (until I got tired of it). And SO kept letting me know that it was just my password that was the problem. That is a problem (to me anyway). And there is no lockout policy or anything after several failed attempts. What do you guys think?
An error message that tells you if your user name was invalid cannot decrease the security if there are other ways of confirming the existence of a username, such as a public username list, or the registration form rejecting existing usernames.
If those other ways exist, the clearer error message is preferable, since it makes life easier for legitimate users, but doesn't give attackers any additional information.
For SE at least two such channels exist:
- Rejection of emails already in use ("Protected" by a captcha)
- Gravatar email hashes (Susceptible to offline brute-force)
Unless both of these channels are eliminated, making the login error message more vague decreases usability without a security gain.
It's been found that proper error messages significantly reduce login failures. If you don't tell the user their email address isn't even valid they're much more likely to have login failures. This is a significant usability problem.
Security-wise, I don't buy the risk. The true risk comes from:
- People who already know your credentials (you're screwed)
- People who have a really damn good idea what your credentials are (you're pretty darn screwed)
- People who have SE's database (hope you salted your hashes)
This "fix" doesn't realistically prevent any of those attacks. Brute-forcing a password on a known email is still hilariously impractical unless their password was known/obvious, and major hacks that expose large amounts of credentials are done offline with dumps of the database's hashes/plaintext. Being a jerk to users doesn't prevent that.
Also, if you want to kill usability for questionable (at best) security, you'll want to take the ax to this "vulnerability" as well:
As long as account recovery options exist and expose emails, you may as well keep logging in as painless as possible.
What you're describing is less an issue with security and more and issue of privacy. This is one of those times that a good user-experience and good privacy cannot co-exist.
If SO acknowledges that I have entered a correct email but incorrect password, SO can tell me as much and even offer to reset my password. The privacy leak occurs in that any third party can now tell whether or not I am a member of this site by attempting to login with my email.
This is actually pretty important in cases where I may not want to expose that my "professional persona" email is tied to, say, a dating site or a radical political party site. The same really cannot be said for Stack Overflow. It's a Q&A site about technology. In this case I think the improvement in user experience far out-weighs the risk of simply exposing that an email has been used to register, especially since this in no way allows somebody to tie your email to your user or your activities within the site.