Specific messages for wrong password or wrong mail - which is the correct practice?

Question

I built two different error messages in login flow. One for when users err the mail and another when users err password.

The developer whom I'm working with suggests to let just one message to avoid hacking attempts.

The question: Is it this important? My intention is to avoid frustration and be clear about the potential problem.

Note: The app is for parents picking up kids at school, so privacy and security are relevant things.

I'm not completely sure that this question is about user experience, although it might affect it tangentially.

Answer 1

Giving separate error messages for a wrong password vs a wrong username (or email) allows users to easily find out whether or not a given username exists in your system. All they have to do is enter that username/email and a random password: if they get the "wrong password" message they've confirmed that that user exists; if they get the "wrong email" message they've confirmed that it doesn't.

This does leak some information that probably should be kept secret, so to that extent it is a security lapse. How serious a security lapse it is is debatable and probably depends on your audience -- though based on my highly rigorous testing mechanism of attempting to log into a bunch of different web services with the wrong password, the majority of websites do use a generic error message ("The email address or password you entered is incorrect") to avoid leaking this information.

(Facebook was the sole exception I found, presumably because there the existence of a given username is already public information.)

In your case, I'd definitely go with the generic message. Even aside from it being a potential vector for phishing or social engineering attacks, there are valid reasons why parents might not want that sort of information to be generally available.

Answer 2

There is no one universal answer. IMO, the developers have a relevant argument: security.

Alternately, as a UX Designer, I alway favor my user's experience: be specific in which field was wrong. Your app sounds like something that parents need working without hassle. As a parent, I would hate to have to visit my email, reset password, etc etc because picking up my kid is a TIMELY PRIORITY.

In my company, security is left to the developers. UX is allowed to dictate the presentation and flow of experience. Developers have to come up with clever security to satisfy the UX solution. Somebody is going to have to do extra work for your problem: will it be you, your visitor, or your developers?

As a UX designer, decisions are made to help the user. And the user should not be the one who has to do extra work.

If the developers do not wish to do extra work -- offer low investment ideas. For example, lockout a user after 3 incorrect attempts.

Answer 3

I would suggest having a single error message indicating that either the username or password is wrong. The added security benefit out weighs the potential frustration in my opinion. There are only two possibilities for what they entered wrong (I suppose it's technically three, since they could enter both things wrong), so it's not a lot of work on the user's end to retype things.

I think the security concern is mainly about privacy of information. Even if you implemented a lockout after some number of failed attempts, having separate messages gives someone knowledge that a particular email address is valid. This information could then be used for other hacking/phishing attempts that go beyond your particular app.

Answer 4

I find it best to weigh the pros and cons, and try to fully understand the risk. Then you can make an educated decision about what is best for your specific case as everyone will be different.

What is the risk of multiple error messages?

As your developer noted, there is an inherit security risk with providing separate messages. If a malicious user comes to your site and begins plugging away at emails, when your app returns a "Sorry email does not exist" error they will know that account does not exist. But then they find one that says "Sorry wrong password" they now know they found an email registered to the site. Now that they have one part of the account they can then start trying to hack in, via brute force or by sending phishing/social engineering emails to the newly found account. With some sites, you could also use the knowledge of an active account as a blackmail technique. Imagine if you knew the email of someone, say Ted Cruz*, and tried entering it on an Adult Video website and it returned the "Sorry wrong password", then you would know that email has signed up for an account. This information could be embarrassing if leaked to the public.

How does a single error message fix this?
By providing a single error message "Email or password is incorrect. A malicious user now has no clue as to whether the email is taken or the password is wrong. It provides them no leverage to stage an attack or other malicious activities. But as you noted, for regular users the UX is worse. If it does not explicity tell me which input is incorrect I won't know (immediately) if I used the wrong email, if I had a typo in it, or if I just typed the password incorrectly, all of which could be solved with multiple messages.

Is it right for me?
This is something you will have to decide for yourself. Do you think you'd be at risk for an attack like that? If someone does break in what are the risks? Do you value UX or Security more?

Important consideration
When registering a new account, does the server respond "Email already in use" if it's already registered? If so you're solving nothing by forcing a single error message, as it leads to the same result.

*Any names used are fictional. Any resemblance to actual persons, living or dead, or actual events is purely coincidental.

Answer 5

I'm assuming that there are no other holes revealing existing usernames, otherwise closing this hole is pointless.

Consider letting the app remember the username even when they leave the app or log out. This covers 99% of the cases and provides for better UX as they have less to type.

Obviously, it's a security risk on its own, but when the username is the email address, it's a pretty harmless as it's easy to find it in the phone anyway. Make the user aware of the app persisting the username and give them the choice to switch this feature off:

• Show a dialog when they leave the app (or log out) the first time.
• Provide the option in the app settings.

Using this option, typing in the wrong username gets very rare and there's hardly any need to use two different messages on login failure.

Answer 6

This is one of the great debates: should developers be in charge of decisions about user interaction, even if related to security? IMHO, the answer is NO. You're the one that defines the interactions and the flow, you're the one that knows a lot of things developers won't know.

As a matter of fact, the man who created some of the most ludicrous password requirements followed by most sites and applications admitted he was wrong and his own recommendations do more harm than good!

So, if your developer says there are security concerns, there might be a chance he is correct (hint: there always are security concerns, doh!), but his work is to work around those concerns, not to tell you your work is wrong just because.

From an usability point of view, what you did is correct. You're helping users know there's a problem with ONE field, so they can correct it. If you don't do this, user will need to try different combinations of user/pass, probably locking her out of the system, blocking access and frustrating the user to incredible levels. Reducing friction is always good, so if you can reduce it... do it!

As for the argument "they will know part of the combination", hackers don't just type addresses until they find one. They use sophisticated algorithms that are completely automated, so the worse that may happen is the hacker will be delayed. On the other hand, your user will go bananas.

Besides, it's a known fact that most users have 1 or 2 "secure" passwords. After you start to kick them out and have them create passwords, they end doing the obvious thing: create easy memorable passwords, such as... birth dates. Or just write their passwords on a paper they take with them, or a file in their computer or phone (thus, opening the door to anyone that steals their wallet or phone, or have access to their computer. The ANTI-SECURITY at its best!)

Since I know you speak Spanish, take a look to this article: Cuando más seguridad es igual a inseguridad and you'll be able to see some of teh concerns around passwords, general security and its UX implicantions. It includes a study we did over 48 users (it's related to credit cards, but some of the insights apply to your case)

In short

Your approach is correct, you're reducing friction, hence users will have more control, won't be blocked and won't need to create insecure passwords every time you block them out. It's up to the developer to create the correct security measures for a good approach, it's LITERALLY their job

Answer 7

Much of the time, returning a message along the lines of "Invalid username or password" but actually does very little to mitigate the underlying concern.

For example, on many sites you can also attempt to register a new account, and look for the message "This account is already registered!" or attempt to recover a password and look for a message similar to "This account does not exist, create a new account?"

In an attempt to be truly secure, we'd need to do something like: 1) hash and send the username and password as a single value, return on success or failure 2) Password recovery "sends an email if the account is on file" as well as any for any attempted registrations

The problem with the secure approach is you have created a black box for anyone who can't remember which username, email address, or password they used.

Did I use Bob, BobSportsFan, [email protected], Bob@hotmailcom, or which of the 400 passwords?

If I attempt to recover Bob, how long do I wait for a recovery email that might never come?

Conclusion

If you already have built a black hole, where nothing on the page will help someone sign in, or signup without exploring their email... Sure, add that extra security.

If your API and UI provide verbose feedback or on-page recovery of some sort... Be as verbose as you can with your user because you aren't fooling the real threats.

Answer 8

As a UX Designer, my duty is to create the best experience possible. The security system should establish the best approach to avoid further problems like those that you described with the security.

Mention a specific field that contains an error is an issue? Then some solutions are needed. Let's start resolving the issues from the beginning. The journey of our user includes an error at the beginning, from now on we will take care of security issues.

Please do not keep ignoring the usability and the user experience of our users.