7

I built two different error messages in login flow. One for when users err the mail and another when users err password.

The developer whom I'm working with suggests to let just one message to avoid hacking attempts.

The question: Is it this important? My intention is to avoid frustration and be clear about the potential problem.

Note: The app is for parents picking up kids at school, so privacy and security are relevant things.

I'm not completely sure that this question is about user experience, although it might affect it tangentially.

6
  • 2
    Short answer is war dialling. If you have two messages, can try lots of usernames until get a valid one, then try passwords. With one message, you'd never know if the username or password was correct, so search for valid pair becomes vastly bigger. Sep 14, 2017 at 18:42
  • @SteveJones and your user will get frustrated and probably leave your service
    – Devin
    Sep 14, 2017 at 18:53
  • 1
    See related questions on security.stackexchage.com. If there's some other way valid logins can be enumerated on your website (e.g. self-registration), then there's no real additional security from having vague error message in the login flow. Else, if it's possible to keep secret which users are valid logins, then it's worth keeping it secret (with a generic single error message). Sep 15, 2017 at 0:13
  • 7
    Possible duplicate of How to tell the user his login credentials are incorrect?
    – clickbait
    Jun 14, 2018 at 6:37
  • I was just solving exactly this problem and reading the answers here I am thinking, is there really any added security displaying the generic message "Invalid username or password", when potential attacker can do exactly the same thing with registration instead, where you kind of "have" to tell the user when the email address he attempts to use exists? Jun 7, 2019 at 4:29

8 Answers 8

8

Giving separate error messages for a wrong password vs a wrong username (or email) allows users to easily find out whether or not a given username exists in your system. All they have to do is enter that username/email and a random password: if they get the "wrong password" message they've confirmed that that user exists; if they get the "wrong email" message they've confirmed that it doesn't.

This does leak some information that probably should be kept secret, so to that extent it is a security lapse. How serious a security lapse it is is debatable and probably depends on your audience -- though based on my highly rigorous testing mechanism of attempting to log into a bunch of different web services with the wrong password, the majority of websites do use a generic error message ("The email address or password you entered is incorrect") to avoid leaking this information.

(Facebook was the sole exception I found, presumably because there the existence of a given username is already public information.)

In your case, I'd definitely go with the generic message. Even aside from it being a potential vector for phishing or social engineering attacks, there are valid reasons why parents might not want that sort of information to be generally available.

4

There is no one universal answer. IMO, the developers have a relevant argument: security.

Alternately, as a UX Designer, I alway favor my user's experience: be specific in which field was wrong. Your app sounds like something that parents need working without hassle. As a parent, I would hate to have to visit my email, reset password, etc etc because picking up my kid is a TIMELY PRIORITY.

In my company, security is left to the developers. UX is allowed to dictate the presentation and flow of experience. Developers have to come up with clever security to satisfy the UX solution. Somebody is going to have to do extra work for your problem: will it be you, your visitor, or your developers?

As a UX designer, decisions are made to help the user. And the user should not be the one who has to do extra work.

If the developers do not wish to do extra work -- offer low investment ideas. For example, lockout a user after 3 incorrect attempts.

2
  • 2
    "Alternately, as a UX Designer, I alway favor my user's experience." <- security is part of UX. You're taking the quick way out by saying it's "extra effort". Find a better solution instead of saying "yeah but it's extra effort". Also, sometimes, extra effort is a good thing. Hard to read copy can increase reading comprehension if designed well. A long form can make people feel more invested. And to come back to this case; being used to the "username and password combination incorrect" can make "wrong username" look insecure for certain audiences. Don't take shortcuts!
    – Dirk v B
    Sep 14, 2017 at 22:51
  • You're mentioning three parties which should do the extra work, but there are just two choices: To show the same or a different message. So you must be wrong. +++ Lockout after 3 incorrect attempts or something smarter is needed in any case.
    – maaartinus
    Sep 15, 2017 at 0:02
1

I would suggest having a single error message indicating that either the username or password is wrong. The added security benefit out weighs the potential frustration in my opinion. There are only two possibilities for what they entered wrong (I suppose it's technically three, since they could enter both things wrong), so it's not a lot of work on the user's end to retype things.

I think the security concern is mainly about privacy of information. Even if you implemented a lockout after some number of failed attempts, having separate messages gives someone knowledge that a particular email address is valid. This information could then be used for other hacking/phishing attempts that go beyond your particular app.

1

I find it best to weigh the pros and cons, and try to fully understand the risk. Then you can make an educated decision about what is best for your specific case as everyone will be different.

What is the risk of multiple error messages?

As your developer noted, there is an inherit security risk with providing separate messages. If a malicious user comes to your site and begins plugging away at emails, when your app returns a "Sorry email does not exist" error they will know that account does not exist. But then they find one that says "Sorry wrong password" they now know they found an email registered to the site. Now that they have one part of the account they can then start trying to hack in, via brute force or by sending phishing/social engineering emails to the newly found account. With some sites, you could also use the knowledge of an active account as a blackmail technique. Imagine if you knew the email of someone, say Ted Cruz*, and tried entering it on an Adult Video website and it returned the "Sorry wrong password", then you would know that email has signed up for an account. This information could be embarrassing if leaked to the public.

How does a single error message fix this?
By providing a single error message "Email or password is incorrect. A malicious user now has no clue as to whether the email is taken or the password is wrong. It provides them no leverage to stage an attack or other malicious activities. But as you noted, for regular users the UX is worse. If it does not explicity tell me which input is incorrect I won't know (immediately) if I used the wrong email, if I had a typo in it, or if I just typed the password incorrectly, all of which could be solved with multiple messages.

Is it right for me?
This is something you will have to decide for yourself. Do you think you'd be at risk for an attack like that? If someone does break in what are the risks? Do you value UX or Security more?

Important consideration
When registering a new account, does the server respond "Email already in use" if it's already registered? If so you're solving nothing by forcing a single error message, as it leads to the same result.

*Any names used are fictional. Any resemblance to actual persons, living or dead, or actual events is purely coincidental.

1

I'm assuming that there are no other holes revealing existing usernames, otherwise closing this hole is pointless.

Consider letting the app remember the username even when they leave the app or log out. This covers 99% of the cases and provides for better UX as they have less to type.

Obviously, it's a security risk on its own, but when the username is the email address, it's a pretty harmless as it's easy to find it in the phone anyway. Make the user aware of the app persisting the username and give them the choice to switch this feature off:

  • Show a dialog when they leave the app (or log out) the first time.
  • Provide the option in the app settings.

Using this option, typing in the wrong username gets very rare and there's hardly any need to use two different messages on login failure.

0

This is one of the great debates: should developers be in charge of decisions about user interaction, even if related to security? IMHO, the answer is NO. You're the one that defines the interactions and the flow, you're the one that knows a lot of things developers won't know.

As a matter of fact, the man who created some of the most ludicrous password requirements followed by most sites and applications admitted he was wrong and his own recommendations do more harm than good!

So, if your developer says there are security concerns, there might be a chance he is correct (hint: there always are security concerns, doh!), but his work is to work around those concerns, not to tell you your work is wrong just because.

From an usability point of view, what you did is correct. You're helping users know there's a problem with ONE field, so they can correct it. If you don't do this, user will need to try different combinations of user/pass, probably locking her out of the system, blocking access and frustrating the user to incredible levels. Reducing friction is always good, so if you can reduce it... do it!

As for the argument "they will know part of the combination", hackers don't just type addresses until they find one. They use sophisticated algorithms that are completely automated, so the worse that may happen is the hacker will be delayed. On the other hand, your user will go bananas.

Besides, it's a known fact that most users have 1 or 2 "secure" passwords. After you start to kick them out and have them create passwords, they end doing the obvious thing: create easy memorable passwords, such as... birth dates. Or just write their passwords on a paper they take with them, or a file in their computer or phone (thus, opening the door to anyone that steals their wallet or phone, or have access to their computer. The ANTI-SECURITY at its best!)

Since I know you speak Spanish, take a look to this article: Cuando más seguridad es igual a inseguridad and you'll be able to see some of teh concerns around passwords, general security and its UX implicantions. It includes a study we did over 48 users (it's related to credit cards, but some of the insights apply to your case)

In short

Your approach is correct, you're reducing friction, hence users will have more control, won't be blocked and won't need to create insecure passwords every time you block them out. It's up to the developer to create the correct security measures for a good approach, it's LITERALLY their job

11
  • 1
    That's right, @devin. The designer should always champion the User while the developers should always build a good system. And each (UX vs Dev) should respect the decision of the other in their own right domain. If security is such a big deal -- the developers should not be so quick to slap an easy UX fix onto the problem.
    – jhurley
    Sep 14, 2017 at 20:18
  • 1
    This is needlessly combative to the developer, who is raising a legitimate security concern. "You know a lot of things the developers won't know" -- well, it's important to remember that that goes both ways, they know a lot that you don't. Work with your developers, not against them. Sep 14, 2017 at 21:18
  • 1
    I find this attitude that the developer should stay in his fiefdom and the UX Designer should stay in his separate fiefdom really problematic, and leads to badly designed and developed products. I think your combative attitude is the sort of thing that goes a long way towards creating the situation where the developer dismisses usability as a concern, because you're quite literally dismissing their valid concerns based in their area of expertise. Sep 14, 2017 at 22:38
  • 1
    The stereotype of the arrogant designer who thinks he knows everything, when he demonstrably doesn't -- this is where that stereotype comes from. And it makes our job harder, because developers and managers who've been exposed to it are that much less likely to take more thoughtful designers seriously. Sep 14, 2017 at 22:42
  • 1
    The UX decision to allow confirmation of valid username/email addresses would create a potential security hole (exposing the users to potential phishing attacks, for example.) The developer suggested, y'know, not creating that potential security hole, and instead following the UX practice adhered to by the majority of other websites. You characterized that as the developer telling the designer "your work is wrong just because." If you can't see how unnecessarily combative and counterproductive that is... well, I don't know what to tell you. Sep 14, 2017 at 23:36
0

Much of the time, returning a message along the lines of "Invalid username or password" but actually does very little to mitigate the underlying concern.

For example, on many sites you can also attempt to register a new account, and look for the message "This account is already registered!" or attempt to recover a password and look for a message similar to "This account does not exist, create a new account?"

In an attempt to be truly secure, we'd need to do something like: 1) hash and send the username and password as a single value, return on success or failure 2) Password recovery "sends an email if the account is on file" as well as any for any attempted registrations

The problem with the secure approach is you have created a black box for anyone who can't remember which username, email address, or password they used.

Did I use Bob, BobSportsFan, [email protected], Bob@hotmailcom, or which of the 400 passwords?

If I attempt to recover Bob, how long do I wait for a recovery email that might never come?

Conclusion

If you already have built a black hole, where nothing on the page will help someone sign in, or signup without exploring their email... Sure, add that extra security.

If your API and UI provide verbose feedback or on-page recovery of some sort... Be as verbose as you can with your user because you aren't fooling the real threats.

0

As a UX Designer, my duty is to create the best experience possible. The security system should establish the best approach to avoid further problems like those that you described with the security.

Mention a specific field that contains an error is an issue? Then some solutions are needed. Let's start resolving the issues from the beginning. The journey of our user includes an error at the beginning, from now on we will take care of security issues.

Please do not keep ignoring the usability and the user experience of our users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.