18

If I mistype my username or password when logging in to Stack Exchange, the red dialogue box tells me which was incorrect.

If an attacker correctly guesses an email address present in the database and submits a bad password, the dialogue helpfully informs them they've typed an existing email address, but that the password is incorrect.

References as to why this is a bad thing, from Sec.SE:

Can we fix this security bug, or at least have an explanation why it won't be fixed?


Yes, this is a similar question to Don't give away incorrect password/username info, but that question is merely seeking discussion.

It does not have an accepted answer, no employees or Community Mods took notice, and it's tagged with , not . Moreover, it doesn't have / / / so that question does not fulfill this bug report.

8
  • 2
    Related: meta.stackexchange.com/questions/147938/… (since it's only a discussion asking for opinions, not marking as duplicate) Mar 21, 2016 at 13:00
  • @ShadowWizard I just updated my question
    – cat
    Mar 21, 2016 at 13:01
  • 1
    It's a dupe of the title, but the actual question there is only asking for opinions. Mar 21, 2016 at 13:01
  • Note that the answers on "Disclose to user if account exists?" don't really say "this is a bad thing" -- the top answer says this was done for historical reasons that no longer really apply (and really doing this right requires you to build your sign-up UX flow so it doesn't reveal if an email is already in use at sign-up time), and the second answer says this is largely important for websites for which membership might be embarrassing, which doesn't really apply for most (all?) SE sites.
    – apsillers
    Mar 21, 2016 at 13:27
  • Quite probably related: The God Login by Jeff Atwood. The reasoning for actually telling the user they entered a correct e-mail is outlined there. I'm not sure if that's still the de-facto reasoning, but I daresay it's at least close Mar 21, 2016 at 20:37
  • Can we add feature-request to the tags?
    – DnrDevil
    Mar 21, 2016 at 22:48
  • @DnrDevil I'm considering this a security bug; it's kind of weird to file it as both a feature-request and a bug
    – cat
    Mar 22, 2016 at 1:38
  • 1
    @tac still, by marking as feature request you imply "OK, I know this is the current design, but I want you (the SE team) to change it". Mar 22, 2016 at 15:22

1 Answer 1

8

I've asked internally, and it seems that this is currently "by design" rather than accidental, and that initially it was implemented the way you would prefer. As such, it is trying to strike a balance between usability (people fat-finger their details very often) and absolute security. We are familiar with the pros and cons of both, however. I have reopened that discussion.

4
  • Aww, okay, if you insist. :(
    – cat
    Mar 22, 2016 at 13:44
  • 2
    status-review then, or status-bydesign? (or declined) Mar 22, 2016 at 14:43
  • 7
    @ShadowWizard I'm going to mark it by design, but bring it up in our next Monday meeting... which will actually be on a Tuesday because of UK holidays, but it will still be the Monday meeting, because reasons Mar 22, 2016 at 15:30
  • 1
    Thanks. While personally I don't think it's critical issue, all other sites I know (well, major sites at least) act in the different way OP is requesting which is not telling the exact reason of login failure, just saying "email or password incorrect" so I would expect SE to follow. That said, SE is special in many ways, this can be yet another way. :) Mar 22, 2016 at 15:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .