Hacker News Reader

Comment by Tichy | Hacker News Reader

Revealing user names (As in "you are trying to log in as Luke") is usually considered a security issue, though.

This was my first thought as well. I thought it was bad when it just verified that you had used a correct username after attempting to log in, then I kept reading and saw the auto-complete combobox of usernames...

That combobox was baffling.

My first thought was: what about duplicate names?

Then it just gives you the available passwords as well. You select the right combination. Easy peasy.

I believe revealing whether or not an email address has an account is also considered a security issue.

Validation on registration form reveals this already.

Well-designed registration forms should not reveal this. Our registration forms provide the error "Email address or password is incorrect. Please try again." Further, forgotten password forms, etc. should also not reveal this.

Pssst... the registration form, not the login form. As in sorry, we cannot create you an account as your selected username has already been taken.

as a matter of fact, they don't strictly tell you who the person is with an email address... they just tell you that the email address is taken.

Yes, and in this case the designer made a (hopefully conscious) decision that usability was more important to the user than the information that an attacker would gain. These sorts of decisions are the hard part of building web applications; there's no right answer applicable to all situations, you have to use judgment and experience to gauge how to balance the competing needs of your users and your business.

Probably doesn't make much of a difference on those sites that have public profiles, though. They typically have the username in the URL anyway.

... and not to mention a user privacy violation.

How so? Please do elaborate.

(edit) In a context of a system that allows anyone to register new account, which appears to be what the linked article focuses on.

It's probably a minor issue, but if you can check for existing user names, you have a much easier time trying to find the matching password. Also, it could be a privacy issue (knowing user x is a customer of service y). Showing a photo as well...

Of course it depends on the context. On Hacker News all user names are visible anyway.

Reply on news.ycombinator.com