HubertManne comments on wrong password message instead of expired.

wrong password message instead of expired. (piefed.social)

submitted 2 months ago by HubertManne@piefed.social to c/goodoffmychest@lemmy.world

17 comments fedilink hide all child comments

Ugh and many people have made memes and such of this but its so annoying. If your policy says its to old then just have that in the message. Implying its the wrong one just pisses people off. You have a password manager and you know its the right one but you do the forgot password link and then when you put your password manager one in the truth comes out as it says you can't use your current password. I swear non of the actual IT people from my heydey would ever do this. I feel like its the cs/mba types that bring all this bs.

[–] HubertManne@piefed.social [S] 1 point 2 months ago (5 children)

lockouts is a common practice and itself only goes for a period. this is a solved issue. it slows down brute force attacks while limiting the inconvenience. Lets put this to bed shall we. The discussion has gotten off base. Many sites will respond with expired and direct you to the process. Why is that? Do they all have bad security practices? No. Its because @betterdev@programming.dev @corsicanguppy@lemmy.ca @notabot@piefed.social that you only get that message if you entered a correct username and password that is expired. It will not do it if you are brute forcing random crap. replying to expired passwords with wrong password is crap design.

permalink

fedilink

source

parent

hideshow 5 child comments

[–] BetterDev@programming.dev 2 points 2 months ago (4 children)

I can see you're determined to be "right" here and aren't interested in the reason systems are implemented that way. So I'll drop it here and let you "win".

I'm tempted to inform you about DDOS attacks and how allowing all your users to get locked out due to a determined and persistent threat is probably a worse user experience than not having a "Your password is expired, please change it" message, but no, you're totally right, and somehow I just couldn't see your brilliant solution to all the problems I mentioned and was determined to naysay you. My bad.

We could just concede every time to the user experience guys, and hey, we probably should, life's a lot more fun when you ignore security best practices.

permalink

fedilink

source

parent

hideshow 4 child comments

[–] HubertManne@piefed.social [S] 1 point 2 months ago (3 children)

its gracious of you to let me win and just drop it. lockouts has no relation to this scenario outside of its just good practice and if your a security guy you know that. its kinda funny your arguing against them for user experience reasons.

permalink

fedilink

source

parent

hideshow 3 child comments

[–] BetterDev@programming.dev 2 points 2 months ago (2 children)

I'm not.

I'm just pointing out that they open you up to DDOS attacks (and before you point this out, yes there are mitigations for those too)

Anyway, I concede that if you're only returning "expired" responses when the user enters the correct, but expired password, you mitigate a lot of the surface I was referencing.

I was mostly trying to use simplified examples to demonstrate principle, and when you kept poking holes in them, I became frustrated, because I was never trying to holistically describe or prescribe protection against literally every attack vector, I just wanted to explain the specific reasoning why someone would make this choice.

For the record, I'm not a security guy, I don't implement login endpoints, I'm just a nerd that finds this topic fascinating, and I love infodumping when I get the chance. I'm sorry for how it came across.

permalink

fedilink

source

parent

hideshow 2 child comments

[–] HubertManne@piefed.social [S] 2 points 2 months ago (1 child)

account locking is a mitigation for ddos. without it people still cannot log in because that is the nature of a ddos and with it the systems won't put as much processing to the login request. Don't get me wrong its not meant as mitigation of ddos as a purpose of using it but the example of how account locking is going to make user experience during a ddos is ludicrous.

permalink

fedilink

source

parent

hideshow 1 child comment

[–] BetterDev@programming.dev 1 point 2 months ago* (last edited 2 months ago)

Are you deliberately trying to troll me?

Look man, you either completely misunderstood (my bet) or purposefully misrepresented what notabot said, and all I did was come here in good faith and try and explain it to you. You have, for 3 days now, completely missed it, and pointed out that back-end enumeration mitigation isn't the specific feature you're complaining about.

I never once said that it was.

The only concept I've been trying to communicate to you, through my own frustration, is this:

On a simple login endpoint, if there's bits of information that differentiates one scenario from another, then you have provided a vulnerable surface that can be abused to extract information.

It doesn't matter how likely it is.

It doesn't matter how hard it is.

It doesn't matter if we're talking about an embedded device, an api endpoint, or a database server.

It doesn't matter if that information is a response code, a failure message, or a response time.

If youre responses are differentiable based on enumerating the possible inputs, that leaks data.

I'm aware that has nothing to do with showing you a pretty little message. I just wanted to be a source of information for you.

I have been patiently explaining the core of the above concept through simplified examples, and attempting to engage in a meaningful discussion where (hopefully) you walk away knowing something new.

I never set out to lay out the grand design of a perfectly impregnable digital fortress, nor by contrast explain the nuances of every single technique in the hacker's arsonal. I never suggested you were wrong that websites can securely tell you your password's expired. I was explaining the idea behind notabot's comments which you clearly didn't understand.

That's not to say I agree fully with notabot, but they came here, and they tried to tell you about a concept they knew a bit about. That's kind. Correct or not, they tried doing something nice for you.

You mischaracterized what they were trying to say, so I tried to step in and fill in a few conceptual blanks for you. Next time I'll just keep my mouth shut. I'm sorry I intruded into your safe space where you just wanted to feel vindicated in how you felt due to a bad user experience.

Have a nice life.

P.S. DDOS doesn't mean what you think it does. Its broader than that. DOS = Denial of service. That can take many forms. One form would be overwhelming the infrastructure and causing the service to stop responding. That's what you're thinking of. Another form would be making it where all the users can't log in. Same effect, the service isn't being provided anymore. Nobody can log in. D = distributed, meaning you can't just IP block the jerk who's keeping your users locked out. And locked out doesn't necessarily mean what you seem to think it does either. One form of lockout means "contact the admin so they can unlock your user", another means I just keep failing to sign in as you, hundereds of times, and the service never lets the real you in, correct password or not. I hope you at least learned a few new words today.

permalink

fedilink

source

parent