User name not found or incorrect password

Question

In many applications when you make a mistake in either your user name or password you get a non-specific error indicating that either the user name entered does not exist or the password is incorrect for that user name.

I (naively) would expect the application to specify which one of the two errors happened. Is there any reason for not differentiating between them? I guess it would make it more difficult for an attacker to guess a correct user name/password combination, but is there any literature, research or similar that backs up this assumption?

Answer 1

The reason would be security: it prevents finding out which user names exist based on failed attempts.

This should be balanced with the user experience; if you're told that either your user name or password is incorrect, it can be perceived as very unhelpful or annoying.

Answer 2

Common sense dictates that an ambiguous message is better because an attacker would be unable to know if they had guesses a correct username.

Answer 3

It's an extra hoop the attacker needs to jump through. If he's cold-attacking an application he won't know any usernames or passwords. Why give him an extra bit of information to tell him that he has found a username? It's better to withhold the information.

What if the attacker is just looking to confirm that a particular username exists? Say, the name of a politician as a username for a fetish site, as an example. The username itself is sensitive information and you do not want to confirm which exist and which do not.

Answer 4

Yes, that’s exactly why many apps/sites do not specify which part of the login is bad. I used to have the same complaint, but then I read a bunch of computer security books including 19 Deadly Sins of Software Security. Among other things like overflows and SQL injection, Michael Howard does explain the reasoning of returning a unified error for logins.

HTH

Answer 5

it's all about giving an attacker as little information as possible. Some sites go even further with this on password reminders. When you input your email address to receive a new password or a password reset link they don't tell you if your email address is registered in the database but give you a message like this: "if the email address you entered is in our database you will receive a message..." This prevents the attacker from finding out which email address was used by the victim and may also announce the victim that someone is trying to break into her account.