Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

When a user has entered incorrect details into a login form, is it better to tell them:

  • The username or password you have entered is invalid.

or

  • The user name you have entered is invalid (for invalid usernames)
  • The password you have entered is invalid (for valid usernames but invalid passwords).

The first approach "might" be more secure, as the an attacker would not be able to confirm whether the username/email address is valid. At the same time, the user might get frustrated by not being able to remember the email address or username he signed up with.

The second apporach is clearly more user friendly, but an attacker would be able to work out what a valid username/email is, and then launch an attack on guessing the password.

Some examples:

  • Amazon: There was an error with your E-Mail/Password combination. Please try again.
  • Hotmail: That Windows Live ID doesn't exist. Enter a different ID or get a new one. and That password is incorrect. Try again.

Which way should I go about displaying those errors?

share|improve this question
3  
How important is security for your site. The best approach for Paypal could be different from your personal blog comments. –  Emil Nov 4 '11 at 2:28
3  
Yep, this is a security thing. Best UX is to tell them the exact problem, you'll have to decide if the "ease" of attacking is a significant great v how easy you want the site to be to access. –  Ben Brocka Nov 4 '11 at 3:02
    
I personally like the combo. Makes me fell warm and fuzzy. This means people just can't put in an email and see if it exists. This happened on facebook and people got pissed about it. –  Matt Nov 4 '11 at 7:20
    
@BenBrocka: This has nothing to do with security - it's a logic issue. –  JohnGB Nov 4 '11 at 11:13
3  
@JohnGB As the hotmail example shows, this is not only a logic issue, there IS more information than just "that pair is wrong," especially in the case where that user name doesn't exist! –  Ben Brocka Nov 4 '11 at 15:39

8 Answers 8

up vote 36 down vote accepted

You have to go with the first option (stating that the "username or password is invalid"), and this has nothing to do with security.

Let's say that I usually use JohnGB as my username, but on your service someone else has that username, so I use JohnGB123 instead. Say I've then forgotten my username and I enter JohnGB as my username, but use my correct password.

Is that a correct password and incorrect username or a correct username and an incorrect password?

There is no such thing as having a correct username without its matching password, and no correct password without its matching username. Usernames and passwords only represent anything when used in combination.

Edit: If the username doesn't exist then of course you should consider letting the person know that. You may run up against privacy laws if you do the same thing with an email address though, so you should be careful.

share|improve this answer
2  
yet saying "at least one of them is wrong" gives no more information. If you put down a non existing user name - that's an error you can be told about, whereas the other way around you'll just know one of them is wrong. It's still true that if a mistake was made in both then the user cannot be told so, but in that case the other option doesn't add any info as well. –  Assaf Lavie Nov 4 '11 at 11:59
    
@AssafLavie: You could say that the username exists, but you can't logically say that it was the right username. Also, if you're storing passwords in a sane way, then there is also no way of querying a particular password exists. The limitations are still logical and technical. –  JohnGB Nov 4 '11 at 12:44
2  
I never suggested you could say that a password exists. You have 4 options: username/pwd can be correct/incorrect. Now if you only ever tell people "the combination is wrong" they never know which part they got wrong. That's the lowest amount of information you can share (hence people worrying about security). The other option shares more information with the user. Yes, in some cases you still don't really know what's wrong, but in other you do (e.g. non existing user name). Please see my comment to my own answer. You have to consider the "expected" UX. –  Assaf Lavie Nov 4 '11 at 14:07
1  
@Assaf the thing is that username/password aren't two things. They are just two parts of one login. You can only judge if the login is correct as a pair. You can't assume one is correct when the other isn't. –  DA01 Nov 4 '11 at 15:23
    
Usually when people fail to log in they're entering the wrong password to the right user account; it's true that you can't know if it's the right user name, but it's a very different thing to say "holy crap, that user name doesn't even exist what are you doing" than to say "You're using the wrong password." If the username does not exist and you just say "the combo is wrong" you're leading them down the same path of letting them try different passwords for an account they can never access. –  Ben Brocka Nov 4 '11 at 15:36

We had a similar discussion on the best option to use on our site. Ultimately, it depends on the nature of your site and the level of security you'd wish to provide your users. We run a jobsite, and ultimately our call was to go with the Amazon approach, because we wanted the additional layer of security for our users.

share|improve this answer

I think the security is a non issue, unless it's a penis enlargement site where being a member is something users would appreciate to be discreet. Most sites that choose option #2 still allow you to recover a password by email and then let you know if no such username exists in the database...

From a hacking standpoint it doesn't really offer much of an advantage if the system answers that a username exists. Reasonable systems won't allow too many attempts anyway, so the most a hacker can get is confirmation for a well known email/username that he's trying to hack. An if someone's a direct target their username/email is probably already known.

Many people use the same email address and/or username in all websites. So basically any admin of any of these websites already has this so called sensitive info. Nobody seems to have a problem with that, because the strength lies in the password, no the user name.

share|improve this answer
2  
But what about the case where I think I am using the correct username, and the site is leading me down the path saying that my password is wrong, but the username exists? Poor UX regardless of any security questions. –  JohnGB Nov 4 '11 at 12:45
1  
I would argue that this happens very rarely. People forget/mistype their passwords way more often than they do their username/email. Furthermore, you get to actually see your username in clear text. I do agree that in those cases the UX is poor, but the overall expected UX is better. –  Assaf Lavie Nov 4 '11 at 14:05
    
@JohnGB More and more sites are using emails and openIDs to log in now, it's considerably less likely for someone else to have signed up for the service using my own email or Google account. –  Ben Brocka Nov 4 '11 at 15:38

If you are concerned about security issues, you should not distinguish between the wrong username and the wrong password.

That said, if you had two fields in anything other than a login page, and one of them were wrong, it would be unhelpful for the error message to read, "One of these two fields is wrong but I won't tell you which one." While the username and password must be validated as a pair, the password is much more likely to be wrong than the username because the password field is usually configured so that you cannot see what you are typing.

share|improve this answer

The answer depends strongly on the system for a few reasons. A valid point is raised in saying you can't know if they have the "right" username if they don't have the right password, for example John states he might be trying to access the wrong John. But there are multiple situations where telling me the username exists can help me.

The username doesn't exist: There is no non-security reason not to let your user know this! In this case you actually know the username is wrong, not the password or the username/password combo. There's no sense in letting a user type furiously away to login to a non-existing account unless they're a bot/malicious agent. You can helpfully offer something like "Are you trying to register? Click here..." in this case as well, in case the user really doesn't have an account and they need to amke one.

My username/login is my email: Unless someone else stole my email, you can pretty fairly assume the user typed their email right and they aren't confused. Unlike the username system where names like Bob and John are taken immediately, in an email-based login system people's perferred login credentials are always availible because only they have access to them in a well designed system, as only the person with control of the email can finish creating an account for that process.

My login is an OpenID: Same reasons as above. No one else could have used my login without access to my credentials. With the advent of OpenIDs and the popularity of email-based login, many users no longer have to worry whether I signed up as John453453 here or John543553 instead.

That all said, the "wrong password" message does err on not helpful; you can't tell if that password is wrong or right for the user, just if it's wrong or right for the username entered. A system with three messages is probably most helpful:
1:Successful Login! (Password and username correct).
2:Username does not exist! Are you trying to Register? (username not "correct"/existent)
3:Password/username incorrect. (Password and username do not match. Emphasize the password being incorrect here as most people input their password wrong, not their username)

share|improve this answer
    
Getting the username right can be just as difficult as the password - if not even more. People are liable to use the same password regardless (that's another topic). But usernames often have many mutations as they can easily be taken. Using emails to login is easier to trust. I've never liked sites that doesn't accept email for login when they never the less require it anyway. –  thomthom Dec 30 '12 at 14:50

Use both: the first option for the first tries and after 5 consecutive failed attempts switch to the second option.

This way you keep the userfriendliness for the majority of users but it makes the work of the hacker much harder to accomplish: after 5 failures he will have to reset his cookies and change its IP or find out the correct credentials in only 5 tentatives (highly unlikely). At this stage most "attackers" would give up and if he's determined and skilled enough he will probably discard the brute-force strategy anyway.

share|improve this answer
    
Good idea. But this would be far less user-friendly than telling at once. I would give up before a sixth try ! –  Nicolas Barbulesco Mar 24 '13 at 10:59

I'm going to give some advice from a Security standpoint + UX. I wouldn't sacrifice either one for the other. Have both.

  1. There's an important question of secure practices in your question. The Best Practice from a security standpoint is to not identify which entry was invalid, and have a generic answer. Let's ask What Would Google Do and take Google's gmail as an example: You have endenter image description here

  2. Going through the Can't access your account? link, gmail will eventually tell you that this account does not exist:

enter image description here

It's ultimately up to you whether or not you want to do this. From a security standpoint, attackers can begin to collect the valid usernames in your application. From a usability standpoint, you've just helped someone figure out which of their countless e-mail addresses they used on your account, and can get logged in sooner.

Who tells tells you if a name exists?

  • Twitter
  • Hotmail
  • Gmail

The most secure practice is to tell the user something along the lines of: "If a valid e-mail address was entered, instructions to reset you password have been sent"

This won't reveal the username. So your first option is Definitely more secure.

From a usability standpoint, you can definitely provide multiple methods of trying to get back into the account, (login with twitter, gmail, Facebook...there are API's for that).

Check out this Smashing Magazine article that reviews the many approaches to login forms:

http://uxdesign.smashingmagazine.com/2011/08/22/new-approaches-to-designing-login-forms/

Just to summarize: a user might be frustrated that they can't remember which email they used. A user will lose all confidence in you if their account gets hacked because ux trumped security.

I hope this helps Erics, I'm really curious what solution you end up choosing.

Some technical security stuff: To learn more about enumeration and the real danger it causes:

It may also be helpful to learn more about forgot password security from this OWASP cheat sheet: https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet

It gives best practices for business applications, but is also still useful to keep in mind. http://www.gnucitizen.org/blog/username-enumeration-vulnerabilities/

share|improve this answer
2  
So I was just creating an account on a site, and I got the response: Username already exists. If you're going to do something like that, then I'd revise that you don't have to worry about revealing a username as being correct. Though it doesn't mean you have to reveal an e-mail address as being correct. cheers. –  mustefa Nov 6 '11 at 5:44

I agree with JohnGB:

I often get frustrated with sites that tell me "Username or Password is incorrect". But JohnGB's answer above makes sense.

Just to add one of my main frustration stems from the fact that email and username are often not differentiated. For example a site my ask for my email or username but that suddenly opens up a lot more options. Sometimes they also change terminology throughout the registration process!

Be specific and be consistent. if you ask for an email as a login make sure you always refer to it as email! and vice versa.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.