Is using obscure names for login fields pointless

Question

My php user authentication script is based on code from someone who, at the time, was a much better coder than me. As such I trusted that the parts I didn't quite see the point of were better left alone unless I had a good reason to change them. I've since improved and have my own ideas of what should be done.

One of the things in this script is allow you to define (and easily change) a custom name for the html login and password fields.

I guess if someone is trying to brute force their way into an account this would allow you to confuse their script until they notice and react, but otherwise I just don't see the point.

Can anyone explain any real benefit of this before I simplify my script and strip this out?

Answer 1

It's usually an attempt to avoid automatic spiders crawling for login pages that they might be able to brute-force. Whether or not it's effective is questionable; but either way if you think it makes the code more complex than it should be, then it probably shouldn't be there.

Answer 2

Security by Obscurity is no kind of security!
I could just search for input fields and assume that the first one was login and the second one of type="password" is password on the form regardless of their names. This won't stop anyone with even a passing knowledge of HTML and Javascript. A simple Python program using Beautiful Soup and 10 minutes will by pass this "security" for just about anyone that wants to. The barrier to entry of Python, HTML and Javascript is extremely low.

If anyone thinks different they haven't had to deal with having to patch up systems that were breached over and over because of "clever" "security" because these bad assumptions that "it makes it not worth it", if there is money even small amounts of money, it will be worth it for someone out there in the world, that has free time and no other income. And that doesn't even begin to cover the worse problem which is the oft denegrated "script kiddie" griefers that hack things just to be hacking them and causing havoc for fun.

Answer 3

This is probably used to prevent attacks targeting many computers, ie. not a brute force which tries to access your website, but attacks which tries to access any website within a range of IP addresses.

I frequently see in server logs attacks trying to exploit old phpMyAdmin bugs or other frequently used services, even if I don't have any phpMyAdmin on my website. This is quite similar.

Answer 4

I'm afraid there is no real benefit at all, password fields will always be type="password" in HTML which alone pretty much proves the pointlessness.

Other reasons against, any client side app will look at the HTTP requests and responses or the 'password' input (can still do both), intermediary attacks will look at HTTP / TCP packets, and brute force attacks will still brute force (although why they'd bruteforce a 'login' to a site rather than ssh, open ports or try to use known exploits is beyond me.

Hope that helps

Answer 5

The only advantage I can think of is that with all of the easily exploitable websites out there, attackers probably won't even bother with yours if it takes even minimal effort. I'm not sure if it's useful if these things don't change automatically though (since you're not likely to change them manually very often).

On the other hand, if your passwords are vulnerable to a dictionary attack, it's unlikely that anyone would ever break them like this anyway.