Why is the common practice of sign in error message always mix the wrong username/password cases together?

Question

Example: When I try to sign in a service with a Username / Password combination, the error message always returns as "Username or password is invalid." But the actual case is that I input a wrong username which doesn't even exist on this site. Why doesn't the message simply tell me the username doesn't exist?

I tried with several services. Only Facebook tells me my account doesn't exist. Others (Google, Twitter, SlideShare, Yahoo!) just don't rule out the possibility that password is wrong.

I am wondering why this is a common practice. Is it some tradition dated back from old-time limitation which has great potential to improve, or does it behave like this for some legal reason?

Answer 1

It makes sense in terms of protecting the privacy of the users, because the feedback (error message) doesn't categorically inform the potentially malicious person or bot that "you found the right username, now all you have to guess/crack is the password"

Answer 2

Not only is it to protect the privacy of the users but it is also a type of information disclosure vulnerability.

This means that I can go to a login box and try and guess usernames. If the system tells me "invalid username" I now know that the username I entered is invalid.

Answer 3

To answer your question, as others have already mentioned, the practice is in order to increase safety, by not allowing a malicious user or script to know whether a given username is taken (available to try to "hack into"). It is not a legal issue, since, as you noted, not all services do this.

Interestingly, though, in practice this is not all that safer given other design decisions (for an email account, all you have to do is send an email and if it doesn't bounce, you have a pretty good idea whether it is available). Your question reminded me of a great article I read about this a while ago:

Social Login Buttons Aren’t Worth It

Here are the relevant parts:

While researching login patterns in the wild, we also watched some users on our login page, and pinpointed a few smallish things we could change to make getting into the app easier. Our old login form told users, "Your username or password is incorrect," when they may have the username right, but the password was incorrect. If you have 4 possible usernames and 4 possible passwords, you have 16 possible combinations between them—only one of which is correct. That means in this scenario, the user would have 15 chances to make an error when logging in. But when you know specifically that your username is incorrect, odds of failure drop precipitously.

He is referring to the fact that some UX changes in the login screen (for their app) caused a 66% decrease in login failures and a 42% decrease in password resets with an additional 5% decrease the following month.

While researching login patterns in the wild, we also watched some users on our login page, and pinpointed a few smallish things we could change to make getting into the app easier. Our old login form told users, "Your username or password is incorrect," when they may have the username right, but the password was incorrect. If you have 4 possible usernames and 4 possible passwords, you have 16 possible combinations between them—only one of which is correct. That means in this scenario, the user would have 15 chances to make an error when logging in. But when you know specifically that your username is incorrect, odds of failure drop precipitously.

The engineering team, ever mindful of security, argued that being generic about username and password errors makes it harder for bad guys to guess usernames by pounding the form with random words or email addresses. But after some further consideration, we decided that it was a false risk, as the username reminder form already tells you if a username exists, and is not a significant security risk for the bajilions of sites that have them.

So, though it might seem that not informing the user trying to login that "the username exists but the password is wrong" is a security feature, this can be undermined by other decisions, and in reality is fraught with another set of problems itself (bad logins, password resets.. etc). So each case needs to consider all of this in order to make the best decision.

Answer 4

One more reason is that programmers check "if the username/password pair exists". The answer to that can only be "yes" or "no", hence the vague error message.

Answer 5

Something that hasn't been mentioned yet. Many services uses email adresses as user names. If the service said wrong password you know you have the right username. That means someone else can find out what services you're using.

Answer 6

To answer the last question in the comments to the top answer … for forgotten passwords, the common practice is the forgotten password link. From there, it lets you send a reset email to the email address on file for a given username OR it lets you enter the email address associated with your account. This method ensures that only the account holder has access even if the password is forgotten.

Sometimes extra verification is required to send that email to yourself, such as your account number, SSN, father's middle name, or some such question.