I asked this question first on Stack Overflow but it was suggested that Information Security would be a better place for it (pretty obvious in hindsight).
I have a typical web application forms authentication process with two steps:
- Step 1: Request username and password
- Step 2: Request some characters (for example, 2nd, 5th and 8th) from a secret phrase
Should I authenticate the username and password before going to Step 2? Or should I collect all three bits of information (username, password and characters) and check them at the end?
Most websites I've seen check the username and password and if they don't authenticate, never ask for the characters. On the other hand, it could be argued that checking everything at the end and if they don't match, displaying an error message that doesn't explain which bit failed would be more secure. That gives away less information like displaying "Username or password is incorrect" (without specifying which) in a simple 1 step authentication.
The problem with the second approach (aside from being less user-friendly) is that Step 2 requires obtaining a valid user in Step 1, otherwise it's hard to know the length of the secret phrase to ask for valid characters (there's no point asking for the 10th character if the phrase is only 9 characters long). The application would also have to hold on to the password in a secure manner between the two steps.
So which one is better? Is there a third approach I should consider?