How to tell a user their login credentials are incorrect?

Question

When a user has entered incorrect details into a login form, is it better to tell them:

• The username or password you have entered is invalid.

or

• The username you have entered is invalid (for invalid usernames)
• The password you have entered is invalid (for valid usernames but invalid passwords).

The first approach "might" be more secure, as the an attacker would not be able to confirm whether the username/email address is valid. At the same time, the user might get frustrated by not being able to remember the email address or username they signed up with.

The second approach is clearly more user friendly, but an attacker would be able to work out what a valid username/email is, and then launch an attack on guessing the password.

Some examples:

• Amazon: There was an error with your E-Mail/Password combination. Please try again.
• Hotmail: That Windows Live ID doesn't exist. Enter a different ID or get a new one. and That password is incorrect. Try again.

Which way should I go about displaying those errors?

Answer 1

You have to go with the first option (stating that the "username or password is invalid"), and this has nothing to do with security.

Let's say that I usually use JohnGB as my username, but on your service someone else has that username, so I use JohnGB123 instead. Say I've then forgotten my username and I enter JohnGB as my username, but use my correct password.

Is that a correct password and incorrect username or a correct username and an incorrect password?

There is no such thing as having a correct username without its matching password, and no correct password without its matching username. Usernames and passwords only represent anything when used in combination.

Answer 2

I'm going to give some advice from a Security standpoint + UX. I wouldn't sacrifice either one for the other. Have both.

1. There's an important question of secure practices in your question. The Best Practice from a security standpoint is to not identify which entry was invalid, and have a generic answer. Let's ask What Would Google Do and take Google's gmail as an example: You have end

2. Going through the Can't access your account? link, gmail will eventually tell you that this account does not exist:

It's ultimately up to you whether or not you want to do this. From a security standpoint, attackers can begin to collect the valid usernames in your application. From a usability standpoint, you've just helped someone figure out which of their countless e-mail addresses they used on your account, and can get logged in sooner.

Who tells tells you if a name exists?

• Twitter
• Hotmail
• Gmail

The most secure practice is to tell the user something along the lines of: "If a valid e-mail address was entered, instructions to reset you password have been sent"

This won't reveal the username. So your first option is Definitely more secure.

From a usability standpoint, you can definitely provide multiple methods of trying to get back into the account, (login with twitter, gmail, Facebook...there are API's for that).

Check out this Smashing Magazine article that reviews the many approaches to login forms:

http://uxdesign.smashingmagazine.com/2011/08/22/new-approaches-to-designing-login-forms/

Just to summarize: a user might be frustrated that they can't remember which email they used. A user will lose all confidence in you if their account gets hacked because ux trumped security.

I hope this helps Erics, I'm really curious what solution you end up choosing.

Some technical security stuff: To learn more about enumeration and the real danger it causes:

It may also be helpful to learn more about forgot password security from this OWASP cheat sheet: https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet

It gives best practices for business applications, but is also still useful to keep in mind. http://www.gnucitizen.org/blog/username-enumeration-vulnerabilities/

Answer 3

The answer depends strongly on the system for a few reasons. A valid point is raised in saying you can't know if they have the "right" username if they don't have the right password, for example John states he might be trying to access the wrong John. But there are multiple situations where telling me the username exists can help me.

The username doesn't exist: There is no non-security reason not to let your user know this! In this case you actually know the username is wrong, not the password or the username/password combo. There's no sense in letting a user type furiously away to login to a non-existing account unless they're a bot/malicious agent. You can helpfully offer something like "Are you trying to register? Click here..." in this case as well, in case the user really doesn't have an account and they need to amke one.

My username/login is my email: Unless someone else stole my email, you can pretty fairly assume the user typed their email right and they aren't confused. Unlike the username system where names like Bob and John are taken immediately, in an email-based login system people's perferred login credentials are always availible because only they have access to them in a well designed system, as only the person with control of the email can finish creating an account for that process.

My login is an OpenID: Same reasons as above. No one else could have used my login without access to my credentials. With the advent of OpenIDs and the popularity of email-based login, many users no longer have to worry whether I signed up as John453453 here or John543553 instead.

That all said, the "wrong password" message does err on not helpful; you can't tell if that password is wrong or right for the user, just if it's wrong or right for the username entered. A system with three messages is probably most helpful:
1:Successful Login! (Password and username correct).
2:Username does not exist! Are you trying to Register? (username not "correct"/existent)
3:Password/username incorrect. (Password and username do not match. Emphasize the password being incorrect here as most people input their password wrong, not their username)

Answer 4

I think the security is a non issue, unless it's a penis enlargement site where being a member is something users would appreciate to be discreet. Most sites that choose option #2 still allow you to recover a password by email and then let you know if no such username exists in the database...

From a hacking standpoint it doesn't really offer much of an advantage if the system answers that a username exists. Reasonable systems won't allow too many attempts anyway, so the most a hacker can get is confirmation for a well known email/username that he's trying to hack. An if someone's a direct target their username/email is probably already known.

Many people use the same email address and/or username in all websites. So basically any admin of any of these websites already has this so called sensitive info. Nobody seems to have a problem with that, because the strength lies in the password, no the user name.

Answer 5

If you are concerned about security issues, you should not distinguish between the wrong username and the wrong password.

That said, if you had two fields in anything other than a login page, and one of them were wrong, it would be unhelpful for the error message to read, "One of these two fields is wrong but I won't tell you which one." While the username and password must be validated as a pair, the password is much more likely to be wrong than the username because the password field is usually configured so that you cannot see what you are typing.

Answer 6

Use both: the first option for the first tries and after 5 consecutive failed attempts switch to the second option.

This way you keep the userfriendliness for the majority of users but it makes the work of the hacker much harder to accomplish: after 5 failures he will have to reset his cookies and change its IP or find out the correct credentials in only 5 tentatives (highly unlikely). At this stage most "attackers" would give up and if he's determined and skilled enough he will probably discard the brute-force strategy anyway.

Answer 7

I agree with JohnGB:

I often get frustrated with sites that tell me "Username or Password is incorrect". But JohnGB's answer above makes sense.

Just to add one of my main frustration stems from the fact that email and username are often not differentiated. For example a site my ask for my email or username but that suddenly opens up a lot more options. Sometimes they also change terminology throughout the registration process!

Be specific and be consistent. if you ask for an email as a login make sure you always refer to it as email! and vice versa.

Answer 8

We had a similar discussion on the best option to use on our site. Ultimately, it depends on the nature of your site and the level of security you'd wish to provide your users. We run a jobsite, and ultimately our call was to go with the Amazon approach, because we wanted the additional layer of security for our users.