6

I recently moved to France and had to find a new cell provider, and I settled on Free Mobile. Their login page features a button-push login for the 'identifiant' (username), and a normal form field for the password.

After debugging a bit, it looks like the hidden form field for the username is a 0-10 array of the indexes of the actual buttons, which are toggled by JavaScript. So no matter the (random) order of the numbers on the buttons, the button index is what is recorded in the input. I imagine that the actual index-to-button-order array is stored on the server (unless it's in JavaScript, I'm not that good, in which case wow security by obscurity much?).

Long story short, is this login method actually more secure? For me, it doesn't seem so, and it's so annoying given that it doesn't work with my password manager.

I wonder why certain websites implement this kind of login, because it just makes my life a tiny bit more difficult (and honestly, less-secure since I keep a copy of my username on my computer). Is it actually more secure, the same security as a normal form-based login, or less secure, and why?

Improve this question

4 Answers 4

Reset to default
7

You almost answered your question yourself, I might just try to give some grounds for why it is actually less secure than regular log in forms.

Long story short, is this login method actually more secure? For me, it doesn't seem so, and it's so annoying given that it doesn't work with my password manager.

There is a rule, formulated in security.stackexchange:

Security at the expense of usability comes at the expense of security.

See here.

Called: AviD's Rule of Usability, or how I call it - security through unusability. It basically means that as soon as you decrease the usability of the security measure, security itself will decrease. We can see many such "inventions" in software world:

Improve this answer
2
  • 2
    So you're saying they're not forcing you to stop using a password manager, they're just forcing that password manager to be a post it note on your monitor instead of a cryptographically secure application.
    – corsiKa
    Jan 14, 2018 at 1:35
  • There is only 10 digits not a whole keyboard to tape the phone number which is in 8 positions , where is in OP question the unusability and all the inventions
    – elsadek
    Jan 14, 2018 at 9:41
1

This seems like a classic case of "We don't want automated systems logging in to our site, so we came up with a BSB (Big Stupid Barrier) to make sure only a human (Or sufficiently programmed bot) can get in". This, as others have noted, sacrifices proper security for assumed security through being highly obscure, unusable and annoying, as for your password manager, it's failing too put the right data in because the BSB is actually doing it's job to an extent (Preventing automated from filling) but your hunch is correct, it's actually less secure.

Makes me wonder how dismal their backend security is that they put up a BSB on the front end!

Improve this answer
2
  • Gotta say: what’s preventing a bot from getting hidden input and changing the value directly? A bot has no need to actually click the buttons (neither does the user, in fact). Moreover, a bot could just POST the form params to the login URL and ignore the webform entirely.
    – Chris Cirefice
    Jan 14, 2018 at 21:33
  • @ChrisCirefice a bot need to acquire the right order of the buttons first before the submit with the webform or without it.
    – elsadek
    Jan 15, 2018 at 8:37
0

From a security perspective the only potential advantage I can see is protection from keyloggers. But since this is for the username which is normally considered public information I'd argue this doesn't really apply.

Having had a look at the site personally I don't really understand the point of it.

Improve this answer
2
  • Sophisticated keyloggers do more than just record keystrokes. If they think there's a password screen up, they'll record whatever's on the screen and any mouse movements, in addition to keystrokes.
    – Mark
    Jan 13, 2018 at 19:46
  • @Mark - I was going to mention this but it seems to randomise the order of the numbers so mouse movements wouldn't give you the username. You could theoretically record the screen but for anything that targeted if you had access enough to install a low level key logger your life would be much easier installing an ssl proxy and inject root certificates.
    – Hector
    Jan 13, 2018 at 19:59
0

The display of the digit buttons in different order each time the page is refreshed reminds of the Captcha way to protect web forms from robots.

As mentioned in the other answer this is most probably for user comfort which looks smarter then having a ‘classic’ Captcha below the form.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .