Skip to main content
639 votes

Why can I log in to my Facebook account with a misspelled email/password?

Facebook is allowing you to make a handful of mistakes to ease the login process. A Facebook engineer explained the process at a conference. The gist of it is that Facebook will try various ...
Allison's user avatar
  • 4,035
356 votes

Is there any reason to not show users incorrectly entered passwords after a successful login?

The primary issue is that incorrect passwords have to be stored in a way that allows them to be later displayed to users. Which, as your dev pointed out, means they can't be cryptographically hashed ...
PwdRsch's user avatar
  • 8,446
320 votes

Why did I have to wave my hand in front of my ID card?

Movement that blocks the view of the item under inspection helps to defeat someone trying to use an overlay image on the video as a replacement for the actual item. For instance, I could take a ...
schroeder's user avatar
  • 131k
276 votes

Why did I have to wave my hand in front of my ID card?

Given that this identification was likely performed according to German law, this request was to conform with BaFin Circular 3/2017 which demands (in their non-binding English translation): Any ...
neo's user avatar
  • 1,906
237 votes

Why is Mother’s Maiden Name still used as a security question?

Because people are lazy and/or incompetent. And, well, you know, the Internet is full of chimpanzees. I would argue that all security questions are bad, but using the mother's maiden name is ...
Anders's user avatar
  • 65.7k
200 votes

Is there any reason to not show users incorrectly entered passwords after a successful login?

tldr; this is even worse than not hashing your passwords and storing them as plain text. I agree with your lead dev's concerns. In order to show past incorrect password attempts, you must store them ...
TTT's user avatar
  • 9,222
180 votes

Does anybody not store salts?

Not storing the salt is bad advice. The main purpose of a salt is that each user password has to be attacked individually. If you do not store the salt then, as you said, you need to try every ...
Gudradain's user avatar
  • 7,021
178 votes

Does correcting misspelled usernames create a security risk?

As you said, you saw this on facebook - so I tried these steps: Login with [email protected] and real password -> works Login with [email protected] and real password -> works, too (!) Login with luksa@...
Lukas's user avatar
  • 3,178
145 votes

Is displaying remaining password retry count a security risk?

Locking accounts is a bad idea in the first place. It might seem like you're making your organization more secure by keeping out "bad people" who are "guessing" at passwords using brute force attacks,...
Sean Werkema's user avatar
  • 2,980
144 votes

Logged out of Facebook on all devices on a sudden. Should I be worried about being hacked?

Facebook reported a data leak today and forced a large number of accounts to log off as a precaution. Source: NY Times and Facebook. That NYT article says "The company forced more than 90 million ...
Teun Vink's user avatar
  • 6,938
138 votes

Is it bad practice to use GET method as login username/password for administrators?

This would store the login link with password and username in the browsers history. It could also be accidentally be captured by things like firewall logs, that wouldn't capture post variables.
jdow's user avatar
  • 1,321
130 votes

Is face recognition a good security feature?

No, not really. At least not as primary form of authentication. Biometrics in general are not good for authentication, because: You leave them all over the place, and there is no way to avoid that. ...
tim's user avatar
  • 29.7k
127 votes

Does anybody not store salts?

A 'secret' salt is known as a pepper. From Wikipedia: A pepper can be added to a password in addition to a salt value. A pepper performs a similar role to a salt, however whereas a salt is ...
amccormack's user avatar
  • 3,971
124 votes

Is a redirect showing the password in plain text a security vulnerability?

Definitely problematic - and worth reporting. If the HTTPS is properly protected with HSTS and preloading, then threat actors observing the traffic wouldn't be able to see the GET contents. But since ...
Royce Williams's user avatar
119 votes

Secure way to log in to a website on someone else's computer

This is an interesting question! The rule of thumb is that if someone else has control of the device (and they're determined enough), they will always be able to monitor and modify all of your ...
Cowthulhu's user avatar
  • 1,231
117 votes

Is it unsafe to show message that username/account does not exist at login?

This is a consideration between security and usability, and therefore there is not really a right answer here. So here follows my opinion. If you can keep usernames secret, then do so. In this case ...
Sjoerd's user avatar
  • 31.8k
117 votes

Is a redirect showing the password in plain text a security vulnerability?

This should be reported right away. There is a multitude of possible attacks which could result in compromise of user accounts. The password shown as a GET parameter is not only a vulnerability ...
vakus's user avatar
  • 3,843
116 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

Simple Terms OpenID is about verifying a person's identity (authentication). OAuth is about accessing a person's stuff (authorization). OpenID Connect does both. All three let a person give their ...
Shaun Luttin's user avatar
  • 1,503
113 votes

Is it possible make brute-force attacks ineffective by giving false positive answers to failed log-in attempts?

The answer always depends on your threat model. Security is always woven into a balance between security and usability. Your approach inconveniences the hackers trying to break into the account, but ...
Cort Ammon's user avatar
  • 9,416
112 votes

Why hasn't it become the norm to inhibit repeated password guesses?

I'd like to challenge your assumption that this isn't being done. [warning: wild approximations to follow] Remember that a successful brute-force attack will require millions or billions of guesses ...
Mike Ounsworth's user avatar
112 votes

Is it good or bad practice to allow a user to change their username?

Many people have looked at the reasons not to allow name changes from both a security and a community standpoint. However, there are plenty of legitimate reasons to allow username changes, even if the ...
fluffy's user avatar
  • 1,352
110 votes

What should a verification email consist of?

How are you generating the 25 character string which you include in the URL? Is it completely random, or is it based off the current time, or the users email? It should be random and not guessable. ...
Daisetsu's user avatar
  • 5,130
108 votes

Is Plaid, a service which collects user’s banking login information, safe to use?

I want to point out that despite Plaids apparently honest attempts at security, their approach is a privacy nightmare, as you give full access to Plaid, to all and every single information your bank ...
Ilikeprivacy's user avatar
  • 1,081
99 votes

What's the point of Microsoft Account 2FA if it still lets me log in using password instead?

You didn't actually set up 2FA. You set up your authenticator as an alternative method of single-factor authentication. This is clear from the first screenshot: "... to sign in without a password&...
CBHacking's user avatar
  • 49.6k
97 votes

My email address is being used to enroll for online services. Should I be concerned?

Should I be concerned about this? Yes. This should be of concern to you because an attacker was able to obtain the valid password for your Gmail account. From the details of warning you have ...
hax's user avatar
  • 3,941
92 votes

How can we eliminate passwords given the problems with biometric authentication?

First of all, let's keep in mind that vendors of biometric solutions have a vested interest in badmouthing passwords to promote their own products and services. There is money at stake. They have ...
Kate's user avatar
  • 8,435
90 votes

Wrong password - number of retries - what's a good number to allow?

Unless you have separate means of restricting access to the login form itself, a good baseline is don't have a hard limit. That's because it's way too easy for someone to be completely locked out of ...
mattdm's user avatar
  • 2,711
87 votes

Why can I log in to my Facebook account with a misspelled email/password?

It is long know that Facebook allows you on purpose to log in with the password case reversed or the first character capitalized (see this article). They do this while storing only a hashed password. ...
Ángel's user avatar
  • 19k
85 votes

How to prove that authentication system works, and that the customer is using the wrong password?

There's not a really quick way to prove this because the hash is designed not to be reversible. You could take their claimed password, and manually generate the hash as @TechTreeDev suggested. You ...
700 Software's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible