18

If I mistype my username or password when logging in to Stack Exchange, the red dialogue box tells me which was incorrect.

If an attacker correctly guesses an email address present in the database and submits a bad password, the dialogue helpfully informs them they've typed an existing email address, but that the password is incorrect.

References as to why this is a bad thing, from Sec.SE:

Can we fix this security bug, or at least have an explanation why it won't be fixed?

Yes, this is a similar question to Don't give away incorrect password/username info, but that question is merely seeking discussion.

It does not have an accepted answer, no employees or Community Mods took notice, and it's tagged with , not . Moreover, it doesn't have / / / so that question does not fulfill this bug report.

Improve this question
8
  • 2
    Related: meta.stackexchange.com/questions/147938/… (since it's only a discussion asking for opinions, not marking as duplicate) – Shadow Wizard is Vaccinating Mar 21 '16 at 13:00
  • @ShadowWizard I just updated my question – cat Mar 21 '16 at 13:01
  • 1
    It's a dupe of the title, but the actual question there is only asking for opinions. – Shadow Wizard is Vaccinating Mar 21 '16 at 13:01
  • Note that the answers on "Disclose to user if account exists?" don't really say "this is a bad thing" -- the top answer says this was done for historical reasons that no longer really apply (and really doing this right requires you to build your sign-up UX flow so it doesn't reveal if an email is already in use at sign-up time), and the second answer says this is largely important for websites for which membership might be embarrassing, which doesn't really apply for most (all?) SE sites. – apsillers Mar 21 '16 at 13:27
  • Quite probably related: The God Login by Jeff Atwood. The reasoning for actually telling the user they entered a correct e-mail is outlined there. I'm not sure if that's still the de-facto reasoning, but I daresay it's at least close – Vogel612's Shadow Mar 21 '16 at 20:37
  • Can we add feature-request to the tags? – DnrDevil Mar 21 '16 at 22:48
  • @DnrDevil I'm considering this a security bug; it's kind of weird to file it as both a feature-request and a bug – cat Mar 22 '16 at 1:38
  • 1
    @tac still, by marking as feature request you imply "OK, I know this is the current design, but I want you (the SE team) to change it". – Shadow Wizard is Vaccinating Mar 22 '16 at 15:22
7

I've asked internally, and it seems that this is currently "by design" rather than accidental, and that initially it was implemented the way you would prefer. As such, it is trying to strike a balance between usability (people fat-finger their details very often) and absolute security. We are familiar with the pros and cons of both, however. I have reopened that discussion.

Improve this answer
4
  • Aww, okay, if you insist. :( – cat Mar 22 '16 at 13:44
  • 2
    status-review then, or status-bydesign? (or declined) – Shadow Wizard is Vaccinating Mar 22 '16 at 14:43
  • 7
    @ShadowWizard I'm going to mark it by design, but bring it up in our next Monday meeting... which will actually be on a Tuesday because of UK holidays, but it will still be the Monday meeting, because reasons – Marc Gravell♦ Mar 22 '16 at 15:30
  • 1
    Thanks. While personally I don't think it's critical issue, all other sites I know (well, major sites at least) act in the different way OP is requesting which is not telling the exact reason of login failure, just saying "email or password incorrect" so I would expect SE to follow. That said, SE is special in many ways, this can be yet another way. :) – Shadow Wizard is Vaccinating Mar 22 '16 at 15:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .