468

submitted 3 days ago by NichEherVielleicht@feddit.org to c/programmer_humor@programming.dev

85 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[-] TheFogan@programming.dev 13 points 3 days ago

yeah real question how would the website even know. Whole point is to match the 2 things together. Is hunter2 my password, well that depends who are you, we've got plenty of users that have that hunter2 password

[-] GamingChairModel@lemmy.world 12 points 3 days ago

The website could know whether the username actually exists on the system. But revealing that information is a security weakness because someone could at least learn who has an account at that site (especially if usernames are email addresses, as they often are).

[-] TheFogan@programming.dev 5 points 3 days ago

Right but not only is it a security weakness, but it's also not helpful to the user. Point is the username probably exists in the system.

Say I went to a website to register TheFogan, but TheFogan already exists, so I created TheFogan2.

3 years later I go back to the website, try and log in with username: "TheFogan" password: "Hunter2", and it tells me "your username is right but your password is wrong". But in reality I have the right password for my account, but the site would just think I have the wrong password for the guy who beat me to my account.

So yeah agreed the primary reason for it is security, IE a fully user focused, while having bad security practices would be, a "if the username exists in the system, report "Username and password don't match", if the username doesn't exist report "There is no user by this name in the system". My point is the site only can know if they have a user by that username, not whether that is MY username.

[-] PattyMcB@lemmy.world 1 points 2 days ago

Not unless they store the passwords in plaintext or their hashing implemention is garbage

[-] TheYojimbo@lemmy.world 5 points 3 days ago

Not exactly. It should check for the username and password separately. First check if the user exists, then check if the salted passwords match.

[-] Pika@sh.itjust.works 3 points 3 days ago* (last edited 3 days ago)

Generally speaking, unless you're using OAuth for an authentication, you would check your username and your password at the same time. It's just you wouldn't respond if either existed or not. You would just say invalid username and password combination.

What gets really complicated is the hybrid SSO integrations where they use a username and then if the account has SSO enabled it then redirects you to the sign-in page, Otherwise, it brings you to a password field.

Realistically what these sites should do to prevent that vulnerability would be to make it so you have to click a dedicated sign in with single sign on button. But not everyone does that type of flow.

Granted, this also doesn't include sites that convert your user account into a user ID. And then for your password's table, only give a user ID. Those would require two queries or a join, regardless, because it's two separate data places. One to get the user Id and one to get the passwords