this post was submitted on 18 Aug 2026
14 points (100.0% liked)

Off My Chest

2110 readers
98 users here now

RULES:

I am looking for mods!

1. The "good" part of our community means we are pro-empathy and anti-harassment. However, we don't intend to make this a "safe space" where everyone has to be a saint. Sh*t happens, and life is messy. That's why we get things off our chests.

2. Bigotry is not allowed. That includes racism, sexism, ableism, homophobia, transphobia, xenophobia, and religiophobia. (If you want to vent about religion, that's fine; but religion is not inherently evil.)

3. Frustrated, venting, or angry posts are still welcome.

4. Posts and comments that bait, threaten, or incite harassment are not allowed.

5. If anyone offers mental, medical, or professional advice here, please remember to take it with a grain of salt. Seek out real professionals if needed.

6. Please put NSFW behind NSFW tags.

founded 3 years ago
MODERATORS
orphiebaby@lemmy.world
orphiebaby@lemm.ee
themeatbridge@lemmy.world
14
wrong password message instead of expired. (piefed.social)
submitted 1 month ago by HubertManne@piefed.social to c/goodoffmychest@lemmy.world
28 comments fedilink hide all child comments
 

Ugh and many people have made memes and such of this but its so annoying. If your policy says its to old then just have that in the message. Implying its the wrong one just pisses people off. You have a password manager and you know its the right one but you do the forgot password link and then when you put your password manager one in the truth comes out as it says you can't use your current password. I swear non of the actual IT people from my heydey would ever do this. I feel like its the cs/mba types that bring all this bs.

top 28 comments
sorted by: hot top controversial new old
[–] notabot@piefed.social 11 points 1 month ago (1 children)

From a security perspective the message should always just say "wrong password", rather than giving a hint as to what's wrong. Anything extra leaks information that an attacker will use to attempt to infiltrate that account. That's why mistyping your username will also give that message.

Obviously, from a usability point of view, it's not great, but you're using a password manager, so you know your username and password are correct, so you can assume you need to reset the password if it's not working.

[–] HubertManne@piefed.social 3 points 1 month ago (2 children)

there is a lot of its better security that is pretty weak sauce. changing passwords often even if strong and if you lock out on password attempts. usability should not be second. Sure if it made a major increase in actual security as seen in the wild but that is just not the case. I would argue that not be specific causes user confusion which results in support situations that make it easier for social engineering to work.

[–] corsicanguppy@lemmy.ca 1 points 1 month ago (1 children)

Simply saying "failed login", though, isn't weak sauce; it's actually fundamental and it's effective.

[–] HubertManne@piefed.social 2 points 1 month ago

that would at least be an improvement over expired password. at least that is not specifying its something its not. the weak sauce is not in not giving good feedback. that is just bad. the weak sauce is justifying it as a security measure. you can point to methodology that involves it and sure someone will do what they can to categorize and filter but ultimately how useful it was to gain access is what I question. in most cases I have seen its been bad passwords, leaked passwords, or social engineering.

[–] notabot@piefed.social 1 points 1 month ago (1 children)

Sure if it made a major increase in actual security as seen in the wild but that is just not the case.

Actually there have been multiple breeches that were made possible by identifying people's usernames due to overly descriptive error messages. Knowing the password is expired gives social engineers even more information to work with. You are correct that there is a balance between making the system secure, and making it usable. This is usually addressed by making the password reset process easily identifiable, and straighforward to use.

Passkeys are the next protocol that is supposed to save us from the hassle of remembering username and password, or dealing with expired passwords, and whilst they do have their own problems, they're a definite step away from the frustrations you've described.

[–] HubertManne@piefed.social 1 points 1 month ago (1 children)

putting the username in the message is unnecessary rather than the username used but if they entered the username, which for this type of situation is mandatory, it does not a security issue. im not sure what error messages you are talking about where they get a username in an action that did not require the username but I could see that being bad. not in this situation. Passkeys are something I don't use not having a smartphone or being willing to buy an item for it. I am fine with an authenticator given I can just use software I want but honestly I don't see them as all that useful. if people use a manager and good passwords then I doubt more breaches are from some sort of cracking (given again there should be some sort of lockout) rather than social engineering problems logging in. I know im being a bit flippant. I realize using a hash of a password with time sorta hides it more but it kinda cracks me up they seem fine not having as many requirements as the passwords when the secret is created.

[–] BetterDev@programming.dev 2 points 1 month ago (1 children)

Your message to me reads like someone who is upset, so right up front I'm going to say that I understand where you're coming from and it's not wrong to feel the way you do about this.

However, the other reply-er is right about the security problems with what you're asking, and I'm going to try to illustrate why.

If that's not something you're interested in, you don't have to read this. I'm not calling you out or anything, I'm just trying to fill you in.

Let's imagine I'm a hacker, right?

And I want to get into a particular service, but I don't have any credentials. How to solve this problem?

Let's just try figuring out the usernames in-use first.

I make a web request to the sign in service. I get a "404 Not Found" response (or, in this case, a "no user exists with that username" message on screen)

Awesome, I'll just write a quick script that hammers the sign-on endpoint with every conceivable username I can enumerate. Most get 404s, a few get "403 Unauthorized" (or an "invalid password" message). Those represent real usernames. Great!

Now I just gotta find one person from this list with a predictable password, or enough of an identifiable username to target with a social engineering attack. Bonus points if they have elevated access.

It's true that 2FA, IP based bans of bad actors, passkeys, strong password requirements, password expiration, and more can make this job a little harder, but there's workarounds for all these problems.

That's what they're saying. Not that the server returns your username, just that by providing different responses to to failed login attempts, you make usernames extractable based on your response behavior.

I hope this helps you understand the reasons for the frustrating user experience. Its because they're trying to protect your data (username) from hackers.

[–] HubertManne@piefed.social 1 points 1 month ago (1 children)

that has nothing to do with this example. A valid user name was put in. If it treated all situations the same it would be an issue. If they put a wrong username in you just say invalid password still but saying expired does not give anything away. ugh. this reminds me of the wiping a drive thing. formatting to all zeroes is so slightly less than the dod 14 passes thing as to make no difference.

[–] BetterDev@programming.dev 1 points 1 month ago (1 children)

Ok, great, working from your example and my example combined, in order to continue the illustration:

I'm still the same hacker. I've got the list of valid usernames, and I'm trying to figure out where to put my effort for cracking passwords in.

When I hammered the login endpoint I noticed something interesting:

  • most responses were 404 Not Found (no user by that name)
  • some responses were 403 Unauthorized (invalid login)
    • But the payload of the responses varied across the 403 responses:
      • most had {"error": "invalid password"}
      • but a few had {"error": "password expired"}

This is fantastic! The server's login endpoint gave me all the information I needed to filter this huge list of real usernames into something more reasonable to work with! Additionally, if a user's password is expired, there's a higher likelihood its an abandoned account (won't notice when I log in as them), or someone who doesn't take security all that seriously (ideal social engineering victim), so essentially I have a list of this service's most vulnerable users.

So let's say I take this list and focus all my energy on breaking in as them. Lots of options for that:

  • I could try brute-forcing their password
    • pros:
      • will eventually work (unless the user changes their password to something I've already tried during my attempt)
      • cons:
        • loud, noticeable
        • takes forever
        • costly
  • I could try finding them (lots of people use the same username across services, so I find them on Lemmy, learn their dog's name, country, married status, industry, perhaps even real name, by digging hard enough, then I target my password attempts to probable combinations)
    • pros:
      • learn about people
      • make a few friends along the way
      • higher likelihood of success
    • cons:
      • learn about people
      • make a few friends along the way
  • I could try searching for this username in leaked database tables

... Actually, look, I hope you get it at this point, I don't have to write a book. You don't need an exhaustive list of all the ways people find and crack passwords. You just needed to know how responding with "expired" vs a binary "invalid"/"valid" response weakens security, and if I haven't demonstrated that to you at this point, I'm wasting both of our time.

Responding with additional information makes hackers' jobs easier.

That's what we're all trying to say.

[–] HubertManne@piefed.social 1 points 1 month ago (1 children)

I get your point but again its not very realistic. password lockout makes brute force a thing of the past and manually trying to guess is even worse. you likely would have more success with just trying the list of most common passwords. and remember. You got the supposed user name list from the 404/403 which is not related to being clear about the error for the user I am talking about. further the displayed message can be hidden from api calls but show to the user. it does not need to be plain text as we are talking about user usability.

[–] BetterDev@programming.dev 1 points 1 month ago* (last edited 1 month ago) (1 children)

further the displayed message can be hidden from api calls but show to the user.

The UI has to get the information from the backend somehow in order to distinguish wrong from expired.

The back-end responding differently based on status reveals information.

You say unlikely. I say it depends on how valuable you are as a target.

Edit:

password lockout makes brute force a thing of the past

OK so I just hammer your login endpoint for each user I've found until all your users are logged out.

Then I continue doing this every day until you stop using password lockouts.

ban my IP

Great, I have 8 VPN subscriptions and thousands of potential IPs, let's go for broke here.

manually trying to guess is even worse.

When targeting a single user, sure, but at scale the tables turn. One of your users uses a weak password, or a re-used password.

you likely would have more success with just trying the list of most common passwords.

Yeah this was just an example, I'm not trying to give a tutorial.

You got the supposed user name list from the 404/403 which is not related to being clear about the error for the user I am talking about.

Sorry if this didnt land, but I had hoped my payload thing demonstrated the whole "if the different statuses are distinguishable from one another, you're leaking information" thing.

further the displayed message can be hidden from api calls but show to the user.

Cool but the UI has to know which message to display. No matter how you spin it. You can return 418 "I'm a teapot" responses for expired passwords, and 403 for wrong passwords, and 404 for no user found, but the principle is the same. You are leaking information about the users by responding differently.

it does not need to be plain text as we are talking about user usability.

Sure, it could be no text, and I could still scrape information, so long as the responses are different between statuses.

[–] HubertManne@piefed.social 1 points 1 month ago (1 children)

lockouts is a common practice and itself only goes for a period. this is a solved issue. it slows down brute force attacks while limiting the inconvenience. Lets put this to bed shall we. The discussion has gotten off base. Many sites will respond with expired and direct you to the process. Why is that? Do they all have bad security practices? No. Its because @betterdev@programming.dev @corsicanguppy@lemmy.ca @notabot@piefed.social that you only get that message if you entered a correct username and password that is expired. It will not do it if you are brute forcing random crap. replying to expired passwords with wrong password is crap design.

[–] BetterDev@programming.dev 2 points 1 month ago (1 children)

I can see you're determined to be "right" here and aren't interested in the reason systems are implemented that way. So I'll drop it here and let you "win".

I'm tempted to inform you about DDOS attacks and how allowing all your users to get locked out due to a determined and persistent threat is probably a worse user experience than not having a "Your password is expired, please change it" message, but no, you're totally right, and somehow I just couldn't see your brilliant solution to all the problems I mentioned and was determined to naysay you. My bad.

We could just concede every time to the user experience guys, and hey, we probably should, life's a lot more fun when you ignore security best practices.

[–] HubertManne@piefed.social 1 points 1 month ago (1 children)

its gracious of you to let me win and just drop it. lockouts has no relation to this scenario outside of its just good practice and if your a security guy you know that. its kinda funny your arguing against them for user experience reasons.

[–] BetterDev@programming.dev 2 points 1 month ago (1 children)

I'm not.

I'm just pointing out that they open you up to DDOS attacks (and before you point this out, yes there are mitigations for those too)

Anyway, I concede that if you're only returning "expired" responses when the user enters the correct, but expired password, you mitigate a lot of the surface I was referencing.

I was mostly trying to use simplified examples to demonstrate principle, and when you kept poking holes in them, I became frustrated, because I was never trying to holistically describe or prescribe protection against literally every attack vector, I just wanted to explain the specific reasoning why someone would make this choice.

For the record, I'm not a security guy, I don't implement login endpoints, I'm just a nerd that finds this topic fascinating, and I love infodumping when I get the chance. I'm sorry for how it came across.

[–] HubertManne@piefed.social 2 points 1 month ago (1 children)

account locking is a mitigation for ddos. without it people still cannot log in because that is the nature of a ddos and with it the systems won't put as much processing to the login request. Don't get me wrong its not meant as mitigation of ddos as a purpose of using it but the example of how account locking is going to make user experience during a ddos is ludicrous.

[–] BetterDev@programming.dev 1 points 1 month ago* (last edited 1 month ago) (1 children)

Are you deliberately trying to troll me?

Look man, you either completely misunderstood (my bet) or purposefully misrepresented what notabot said, and all I did was come here in good faith and try and explain it to you. You have, for 3 days now, completely missed it, and pointed out that back-end enumeration mitigation isn't the specific feature you're complaining about.

I never once said that it was.

The only concept I've been trying to communicate to you, through my own frustration, is this:

On a simple login endpoint, if there's bits of information that differentiates one scenario from another, then you have provided a vulnerable surface that can be abused to extract information.

It doesn't matter how likely it is.

It doesn't matter how hard it is.

It doesn't matter if we're talking about an embedded device, an api endpoint, or a database server.

It doesn't matter if that information is a response code, a failure message, or a response time.

If youre responses are differentiable based on enumerating the possible inputs, that leaks data.

I'm aware that has nothing to do with showing you a pretty little message. I just wanted to be a source of information for you.

I have been patiently explaining the core of the above concept through simplified examples, and attempting to engage in a meaningful discussion where (hopefully) you walk away knowing something new.

I never set out to lay out the grand design of a perfectly impregnable digital fortress, nor by contrast explain the nuances of every single technique in the hacker's arsonal. I never suggested you were wrong that websites can securely tell you your password's expired. I was explaining the idea behind notabot's comments which you clearly didn't understand.

That's not to say I agree fully with notabot, but they came here, and they tried to tell you about a concept they knew a bit about. That's kind. Correct or not, they tried doing something nice for you.

You mischaracterized what they were trying to say, so I tried to step in and fill in a few conceptual blanks for you. Next time I'll just keep my mouth shut. I'm sorry I intruded into your safe space where you just wanted to feel vindicated in how you felt due to a bad user experience.

Have a nice life.

P.S. DDOS doesn't mean what you think it does. Its broader than that. DOS = Denial of service. That can take many forms. One form would be overwhelming the infrastructure and causing the service to stop responding. That's what you're thinking of. Another form would be making it where all the users can't log in. Same effect, the service isn't being provided anymore. Nobody can log in. D = distributed, meaning you can't just IP block the jerk who's keeping your users locked out. And locked out doesn't necessarily mean what you seem to think it does either. One form of lockout means "contact the admin so they can unlock your user", another means I just keep failing to sign in as you, hundereds of times, and the service never lets the real you in, correct password or not. I hope you at least learned a few new words today.

[–] HubertManne@piefed.social 0 points 1 month ago (1 children)

its all so disengenous when you take into account my original post. saying theortically this even if in actuality it does not mean much. I also think ddos does mean what I say because anyone who uses it generally means overwelming the system with traffic. your possible other type is almost never talked about. no article talks about a company being ddosed by making loging attempts with a list of users at just the pace necessarily to keep them locked out.

[–] BetterDev@programming.dev 0 points 1 month ago* (last edited 1 month ago) (1 children)

Oh is there some rule that I can't just respond to a comment thread? Every comment has to be about the original post?

Wild. I had no idea. Can you point me to a source for that claim please? As evidenced by the thread, I love learning!

Well, see, there's people who talk about security, and there's people who talk about security. Most people are the former.

But hey, I asked you for a source, it's only fair for me to reciprocate: oh no! You were wrong on the internet today!

[–] HubertManne@piefed.social 0 points 1 month ago (2 children)

you can reply all you want but when its way off base youll get guff for it. I will use the term again but making out like I am citing some imaginary rule is disengenous and contrary to simple communication between individuals. Thats a really great source of page not found btw.

[–] BetterDev@programming.dev 0 points 1 month ago (1 children)

Yeah my bad on the link, I double-pasted. I fixed it now, but here it is again: https://nvd.nist.gov/vuln/detail/CVE-2024-55008

[–] HubertManne@piefed.social 1 points 1 month ago

Thanks. I will point out there is no severity rating or example of it being used in the wild. I don't recall ever seeing a news article on how some company is ailing do to an attack like this. Then after all that I doubt anyone. ever. would think the way to fix it wold be not not have lockouts. which are pretty much a mandatory security item at this point. temporarily for mitigation. sure. in general not having it. you would have to be crazy.

[–] BetterDev@programming.dev 0 points 1 month ago (1 children)

disengenous

You keep using that word. I do not think it means what you think it means.

I was being sarcastic, friend.

And at this point I'm cool with you just being a troll.

I'm a troll too sometimes, I get the thrill. Anyway, it's been a fun few train rides writing this thread with you.

Maybe I'll see you around ;-)

[–] HubertManne@piefed.social 2 points 1 month ago (1 children)

ok you were being sarcastic but that is hard to do on the internet. when you look at me like that it was a joke. fine. then there is nothing to say other than you where being sarcastic in a thread and didn't really mean what you said. thing is it seemed like you were deflecting from your topic which is a common thing a person does who feels like they have to win at all costs so they throw in some unrelated thing and start arguing about that. im sorta glad actually you mentioned it as im looking for a genuine experience (and I certainly do know what the word means even when I misspell it) and I work to keep my feed that way.

[–] BetterDev@programming.dev 1 points 1 month ago (1 children)

On the sarcarm thing, yeah that's true enough. I think I'm funny, but it's impossible for me to predict how that's going to come off to someone who doesn't know me. And sorry if my line about the "disingenuous" thing didn't land, it's a Princess Bride reference, I just wanted to sneak it in there inconceivably.

Nice on the "genuine experience" thing. How's that working out so far? I've had pretty good luck on Lemmy using programming.dev, but I'm usually more of a lurker than a contributor. The only reason I've been active lately is that I've started commuting so I've got some downtime when I can't do much else.

I definitely know what you mean about double-down behavior. I come across it all the time and usually just let it ride. "Not my job" to teach internet strangers stuff lol. I've also been in relationships with people who act that way all the time, on every topic, and eventually it becomes clear that what they're after isn't consensus, its's persuasion, so if I don't budge they feel like they're losing some kind of battle. I've mostly learned to avoid those sorts. If you want to learn to spot it in the wild, I think the term is DARVO.

I am just one of those people who reads wikipedia for fun, watches educational content primarily, and has a million hobbies, so I know a little about a lot of topics. I really want to share that knowledge with people but have a hard time doing so, I think I come off as pretentious, but genuinely don't judge people or rank them into better or worse.

People are just people to me. Sometimes people do bad things, some people do bad stuff all the time, but I know that somehow, in their mind, they think they're right in doing so.

Anyway, I did feel a little spicy last night when I wrote my last few replies, so it makes sense that you read me as being hostile and disingenuous. I wasn't trying to be, but I know I can come off as pretty abrasive when I'm frustrated.

[–] HubertManne@piefed.social 1 points 1 month ago (1 children)

I feel one of the good things with the fediverse is you have a lot of control. I generally champion for as much user control as possible and I saw a lot of it in kbin and when it fell piefed sorta took up the gauntlet. I peruse all and block communities I have no interest in because I want to see new communities I might have interest in which does not work if you subscribe. Piefed tried to solve it with topics but I find all and blocking the way to go. When it comes to users I ususally due dilegence before blocking. Before looking through history to see if its common behavior or if they are just having a bad day. Also if they seem to be real and varied. Like people who only post in one particular way im more likely to as I either think they are bots or just obsessed with one type of thing. Piefed has this great thing now where you can make personal notes on users so its easier to not jump the gun. There are definately some very interesting folk and even things like this are nice as its good to be challenged. Not as much on something with get off my chest which is a community for bitching about something that bugs you but I like places were I can learn something. Ill admit though I have a chip on my shoulder with security in tech from my own IT experiences.

[–] BetterDev@programming.dev 1 points 1 month ago (1 children)

Fair, I totally neglected to recognize that's what you were here for and focused entirely on trying to get the concept across. I don't usually pay much attention to which community I'm reading, I just stick to local for tech stuff and all for everything else. I barely customize the experience at all.

I'm not a security-specific person but I am a programmer, so I will just pass on one tiny nugget of wisdom on the original topic: Yes, what bothers you about the messaging in the UI is possible without compromising security, it's just more complicated and requires a bit more scrutiny and due diligence on the part of the engineering team. However, "possible" and "reasonable" are two very different things in the eyes of a developer. We are typically constrained by tight deadlines, moving targets, and competing priorities, and that often leads to doing the simplest thing that solves the problem now, rather than the elegant and full-featured thing that will make everyone happy. My favorite reference on this topic is SMOP, (Small Matter of Programming) which is basically the idea that I just spelled out. Yes, what you want is possible, but it is more difficult than most people realize to do right.

[–] HubertManne@piefed.social 1 points 1 month ago

Oh I get that but it frustrates me both in personal life and work life. One thing that I have found is quality teams have been tossed out and that type of thing is tossed onto, if your lucky, they customer reps and they generally are low tech techies at best and are put under pressure and such as not to take it into account. Also I feel many places no longer eat their own dogfood. This is a big reason we have the enshitification we have. Its not the only thing but its definately a part of it.