Is there a secure way to remove a user field from a login dialog?

Question

Browsing through Coding Horror, I saw this article on removing the user field from a login dialog.

It's an interesting concept albeit an old one from 2005. Nevertheless, I started thinking about it and wondered:

How would you be able to do this in a secure fashion?

If you identify the user by their password that means all passwords must be unique - yes?

If all passwords must be unique, what do you do when someone enters a password that's already in use?

You can't tell them it's already in use because that would give away someone else's login.

I can't think of a way one could implement this in a secure fashion...any ideas?

G-Man

Answer 1

I believe you cant.

By entering your username you are providing your identity, by entering your password you are providing a means for the server to verify this identity.

Both are inherently required unless you have some other means of determining identity (IP, keycard, etc.)

Basically you cant expect anyone to believe you are who you say you are, when you don't say who you are!

Answer 2

My first thought, which is also alluded to in the article, is to increase the password complexity requirements to avoid collisions.

16-byte GUIDs avoid collisions (every star can have 6.8×1015 GUIDs) well enough, so it shouldn't be too difficult. Obviously human-generated input isn't quite as random, but if you add in enough requirements like lowercase/uppercase/numbers/symbols/length, it might work well enough.

Answer 3

Well, I suppose you could look for some other piece of "uniquify-ing" data, to use in combination with the password. For a web app, this could be a hash inserted in a cookie, from a previous visit. It'd be hard to guarantee uniqueness (multiple users from a single profile on a single computer, for instance).

My bank takes essentially this approach, with my public IP address. It's a little annoying, actually. Every time my DHCP lease expires, my bank's website "un-recognizes" me, and asks one of several security questions, before I get the standard username/password screen.

Multiple-factor security uses something like this (a hardware key or hardware-provided identifier, in combination with a password).

This approach strikes me as overly clever, and clever's rarely the right way to approach security systems.

Answer 4

You do not identify users by password, you identify them by user name. You authenticate users by password. Just think a bit what does it mean to identify by password. I join the system, he asks me to enter my new password. I say 'foo', he says 'foo is already in use'. I say 'tyvm'', and open the login window. When prompted I simply enter 'foo' and he says 'Welcome Mr. President'...

No, there absolutely cannot be a requirement to have passwords unique, that would be a huge security hole in any system because it relies on information disclosure to function: by reveling a duplicate you disclose somebody's password. Even with name/password combinations, once you disclosed that 'password is in use' all I have to do is iterate through the list of accounts trying the password you just revealed to me, and one combination will succeed.