# 'The name or password you entered is not correct' Why not narrow it down? **URL:** \ **Category:** Factual Questions\ **Created:** [July 14, 2010, 3:43pm UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668 "2010-07-14T15:43:05Z")\ **Posts on this page:** 19\ **Page:** 3
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [July 15, 2010, 10:54am UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/41 "2010-07-15T10:54:32Z")
What are these websites that don’t give out your username to absolutely everyone? Even places that change one’s display name tend to leave you some way to figure out the original name. Still, obscurity is only a poor security method when it is used instead of something else. It’s perfectly fine when added on top of an already secure system. There may not be much point, but it doesn’t hurt, so why not? Now, constantly changing it–yeah, that’s stupid. But only in the same way as passwords, as people will write them down. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [July 15, 2010, 12:37pm UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/42 "2010-07-15T12:37:15Z")
> [@kombatminipig](#): > > You obviously don’t understand the semantic difference between obscurity and secrecy. > > Keeping your money under your mattress relies on the knowledge of that money’s existence not being known, nor available through an educated guess. All you need is one person other than you with that knowledge, or one burglar who knows where to look, and your entire security scheme is void. This is security by obscurity. > > By comparison, by storing your money in your bank, you’re free to tell the world what bank you are using, how much cash you have there, you can even (in parts of the world where check fraud isn’t common, such as those parts of the world who have stopped using checks) divulge your account number and your money is still no less secure. The bank (we’ll ignore online banking for the sake of the analogy, security becomes way more complex there) required your presence in order for you to access your account. This is authentication. > > A password is a form of authentication. By being kept secret and easily changed should this secret no longer be so (unlike your hiding place), it authenticates who you are. > > So? You have my username right here, and you’re free to try to use it to hack my account. I don’t need to rely on it being obscure, because I have my password. My password you’re not getting, because that’s my authentication. > You can have my bank account number as well if you’d like. It doesn’t need to be obscure, because any online transaction requires a password. Hell, you can even have the password I just used, because it will be changed as soon as I end the transaction. My pin code and the dongle I use to generate new passwords you’re not getting though, because that’s my authentication. > > Are you beginning to get my drift? Yes. It’s typical of people who parrot that phrase and don’t understand it and it’s surprising how many security professionals don’t understand what they’re saying. Keeping things obscure is a bad practice _if it’s your only method of security_. As part of a security system, it’s essential. The less publicly available information, the more secure you are. Consider: suppose you have an online bank account. If that’s the only public information people have: “I have an online bank account,” you’re more secure than if you say, “I have an online bank account at Wells Fargo bank.” The latter information now allows people to look at one bank instead of hundreds. If you give them your userid, you’re even less secure. Maybe I need to guess the password, but what account to attack and where it is. So the less information you give out, the more secure you are. It is wrong to expect that will protect you by itself, but it is just as wrong to say it is not an effective method of securing your account. ---
**Author:** ![kombatminipig](https://avatars.discourse-cdn.com/v4/letter/k/b5ac83/32.png) [@kombatminipig](https://boards.straightdope.com/u/kombatminipig)\ **Post date:** [July 15, 2010, 12:49pm UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/43 "2010-07-15T12:49:31Z")
> [@BigT](#): > > What are these websites that don’t give out your username to absolutely everyone? Even places that change one’s display name tend to leave you some way to figure out the original name. Facebook is a good example. You log in using an e-mail adress (which can be perfectly secret if need be, but often isn’t), which has nothing to do with the username or your real name. In essence it adds a layer of security, because being the owner of your e-mail account (which can be made extremely secure) further authenticates you (as the creator of the account, not your identity). > [@BigT](#): > > Still, obscurity is only a poor security method when it is used instead of something else. It’s perfectly fine when added on top of an already secure system. There may not be much point, but it doesn’t hurt, so why not? > > Now, constantly changing it–yeah, that’s stupid. But only in the same way as passwords, as people will write them down. As you said, it doesn’t hurt, and it discourages denial-of-service attacks against individual users, as well as data mining, which can be used for other types of attacks. When making a security assessment of a system (imagine that this is your bank), obscurity can’t be counted on. In a cryptographic parallel, an attacker is always presumed to have both the plaintext and cryptotext, and be fully aware of the cryptographic algorithm, yet still not be able to use that information to intercept future communications. Mant cryptographic systems are open source (customers demand full insight), so can’t rely on obscurity even if they wanted to. ---
**Author:** ![kombatminipig](https://avatars.discourse-cdn.com/v4/letter/k/b5ac83/32.png) [@kombatminipig](https://boards.straightdope.com/u/kombatminipig)\ **Post date:** [July 15, 2010, 1:18pm UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/44 "2010-07-15T13:18:33Z")
> [@RealityChuck](#): > > Keeping things obscure is a bad practice if it’s your only method of security. As part of a security system, it’s essential. The less publicly available information, the more secure you are. You’re basically contradicting yourself. If you consider obscurity essential, then you are factoring it into the security of your system. But true obscurity is an illusion and once it ceases to exist can never be reestablished. You’re far better off making the information public to begin with (also raising chances that your holes in your core security will be uncovered in good time) and always presuming that an attacker has access to that information. > [@RealityChuck](#): > > Consider: suppose you have an online bank account. If that’s the only public information people have: “I have an online bank account,” you’re more secure than if you say, “I have an online bank account at Wells Fargo bank.” The latter information now allows people to look at one bank instead of hundreds. If you give them your userid, you’re even less secure. Maybe I need to guess the password, but what account to attack and where it is. > > So the less information you give out, the more secure you are. It is wrong to expect that will protect you by itself, but it is just as wrong to say it is not an effective method of securing your account. I believe that your example doesn’t hold for the following reason: You are unlikely to be specifically targeted. An attacker, unless motivated by a personal grudge against you, is far more likely to target all customers at your bank rather than you personally, so when figuring out how secure your money is, the obscurity of your bank is not a factor you can rely on. Anyway, once you’re logged in to your bank you are relying on a securely established SSH tunnel running medium to heavy encryption (+2048 bit). The time required to figure out what bank you’re using is trivial in comparison to trying to factor a couple of multiple thousand bit primes. Returning to the mattress example, it’s like adding the security of a door knob to the two ton adamantium safe standing behind it. In any case, I was originally criticizing to KneadToKnow’s example of hiding money under the mattress and not telling anybody as entirely void of security. In what way do you disagree with that statement? ---
**Author:** ![Shot\_From\_Guns](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@Shot\_From\_Guns](https://boards.straightdope.com/u/Shot_From_Guns)\ **Post date:** [July 15, 2010, 3:28pm UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/45 "2010-07-15T15:28:03Z")
> [@BigT](#): > > Still, obscurity is only a poor security method when it is used instead of something else. It’s perfectly fine when added on top of an already secure system. There may not be much point, but it doesn’t hurt, so why not? > [@RealityChuck](#): > > Keeping things obscure is a bad practice _if it’s your only method of security_. As part of a security system, it’s essential. The less publicly available information, the more secure you are. Exactly. > [@kombatminipig](#): > > You’re far better off making the information public to begin with (also raising chances that your holes in your core security will be uncovered in good time) and always presuming that an attacker has access to that information. I’d prefer to \*keep the information private \*and assume that an attacker has access to it. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [July 15, 2010, 4:17pm UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/46 "2010-07-15T16:17:05Z")
Another aspect to this whole debate: I already know a username that will grant me access to all of your accounts. I don’t need to know your own personal username; I can just log in as root. Now, one of two things will be the case: Either the password on root isn’t good enough, and I can log in that way and get all the information I want, or the password on root is good enough to keep me out, in which case you have to ask why all the other accounts don’t have passwords that are just as good. ---
**Author:** ![kombatminipig](https://avatars.discourse-cdn.com/v4/letter/k/b5ac83/32.png) [@kombatminipig](https://boards.straightdope.com/u/kombatminipig)\ **Post date:** [July 15, 2010, 4:25pm UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/47 "2010-07-15T16:25:32Z")
> [@Chronos](#): > > Another aspect to this whole debate: I already know a username that will grant me access to all of your accounts. I don’t need to know your own personal username; I can just log in as root. > > Now, one of two things will be the case: Either the password on root isn’t good enough, and I can log in that way and get all the information I want, or the password on root is good enough to keep me out, in which case you have to ask why all the other accounts don’t have passwords that are just as good. Normally they are (besides the fact that most \*nix distributions have done away with the root-account and instead grant sudo-access to individual users). Knowing a username in itself is not a security breach, but gaining access to the list of users does open up for other types of attacks. ---
**Author:** ![cuberdon](https://avatars.discourse-cdn.com/v4/letter/c/45deac/32.png) [@cuberdon](https://boards.straightdope.com/u/cuberdon)\ **Post date:** [July 15, 2010, 4:39pm UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/48 "2010-07-15T16:39:26Z")
> [@Anachronism](#): > > The system has to check if the username exists before it can check if there is a password to go with it. If it does not exist it does not seem like any extra effort to tell the user. Let me guess. You’ve never actually studied computer science. ---
**Author:** ![Shot\_From\_Guns](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@Shot\_From\_Guns](https://boards.straightdope.com/u/Shot_From_Guns)\ **Post date:** [July 15, 2010, 5:46pm UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/49 "2010-07-15T17:46:59Z")
> [@LouiseE](#): > > Let me guess. You’ve never actually studied computer science. I LOL’d. ---
**Author:** ![JCorre](https://avatars.discourse-cdn.com/v4/letter/j/3da27b/32.png) [@JCorre](https://boards.straightdope.com/u/JCorre)\ **Post date:** [July 15, 2010, 7:21pm UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/50 "2010-07-15T19:21:22Z")
Perhaps an anecdote would help here. I used to work in the security department at a very large internet company that takes security very\_seriously. One day another department changed the login page to give the user the exact feedback that is described in this thread (meaning letting the user know if it was the password or the userid that was incorrectly entered). They did this since password/userid recovery was the #1 cause of customer service contacts (as it is for most companies as far as I’ve experienced). In the month subsequent to this change the security department noticed a _significant_ increase in failed login attempts. We’re talking in the millions of extra attempts. Obviously, this did not represent a security “breach” persay since these attempts failed but the attacker was doing this behavior in order to direct other attacks at the company’s users in a more direct and effective way. Needless to say this small change in the login UI was quickly reversed so that they wouldn’t be revealing such pertinent information to any random person that has access to the login page. ---
**Author:** ![gotpasswords](https://avatars.discourse-cdn.com/v4/letter/g/c57346/32.png) [@gotpasswords](https://boards.straightdope.com/u/gotpasswords)\ **Post date:** [July 15, 2010, 8:28pm UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/51 "2010-07-15T20:28:27Z")
[QUOTE=RealityChuck] Consider: suppose you have an online bank account. If that’s the only public information people have: “I have an online bank account,” you’re more secure than if you say, “I have an online bank account at Wells Fargo bank.” The latter information now allows people to look at one bank instead of hundreds. If you give them your userid, you’re even less secure. [/QUOTE] Exactly. I’ve got your user name and the system it’s for. Now, a quick poke at Facebook will probably give me the names of your pets and/or kids, favorite color, favorite food, your spouse’s name, etc. Now I can bang away at one system and one ID with a half a dozen or so likely passwords. Still feeling secure? Or, if the bad guys get ahold of the system’s password file, and they know an ID on the system, it’s fairly trivial to run “crack” on the file with that known ID and soon have everyone’s ID and password. Of course, if they can get the password file, they probably already have elevated access to the server and the game’s over. ---
**Author:** ![Shot\_From\_Guns](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@Shot\_From\_Guns](https://boards.straightdope.com/u/Shot_From_Guns)\ **Post date:** [July 15, 2010, 8:55pm UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/52 "2010-07-15T20:55:26Z")
> [@gotpasswords](#): > > Exactly. I’ve got your user name and the system it’s for. Now, a quick poke at Facebook will probably give me the names of your pets and/or kids, favorite color, favorite food, your spouse’s name, etc. > > Now I can bang away at one system and one ID with a half a dozen or so likely passwords. Still feeling secure? I just feel the need to point out this excellent username/post combo. ---
**Author:** ![kombatminipig](https://avatars.discourse-cdn.com/v4/letter/k/b5ac83/32.png) [@kombatminipig](https://boards.straightdope.com/u/kombatminipig)\ **Post date:** [July 15, 2010, 9:36pm UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/53 "2010-07-15T21:36:27Z")
> [@gotpasswords](#): > > Or, if the bad guys get ahold of the system’s password file, and they know an ID on the system, it’s fairly trivial to run “crack” on the file with that known ID and soon have everyone’s ID and password. Of course, if they can get the password file, they probably already have elevated access to the server and the game’s over. Not quite. The password file will either be rather heavily hashed or encrypted using an appropriate crypto function such as Blowfish. You won’t have enough time to extract any cleartext from such a file before the sun runs out of fuel. The hashed passwords themselves give no access at all, presuming that the system doesn’t have any other serious security flaws. Also, agree on the excellent username/thread combo. =) ---
**Author:** ![cuberdon](https://avatars.discourse-cdn.com/v4/letter/c/45deac/32.png) [@cuberdon](https://boards.straightdope.com/u/cuberdon)\ **Post date:** [July 16, 2010, 3:10am UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/54 "2010-07-16T03:10:45Z")
> [@kombatminipig](#): > > Not quite. The password file will either be rather heavily hashed or encrypted using an appropriate crypto function such as Blowfish. You won’t have enough time to extract any cleartext from such a file before the sun runs out of fuel. For a single hash this is true. However a password file is not a single hash, but contains many entries. The more entries, the better your chance of finding a rainbow table match. Add to this users’ very common habit of using as passwords their spouse’s name, their kid’s name, their pet’s name, important dates, or dictionary words, and it’s much, much easier to break passwords than non-professionals may realize. ---
**Author:** ![gotpasswords](https://avatars.discourse-cdn.com/v4/letter/g/c57346/32.png) [@gotpasswords](https://boards.straightdope.com/u/gotpasswords)\ **Post date:** [July 16, 2010, 4:06am UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/55 "2010-07-16T04:06:51Z")
[QUOTE=kombatminipig] Not quite. The password file will either be rather heavily hashed or encrypted using an appropriate crypto function such as Blowfish. You won’t have enough time to extract any cleartext from such a file before the sun runs out of fuel. [/QUOTE] Ehhh… Go tell that to my Unix server admins. They crack password files when they’re bored. There used to be a commercially-available application with a name that sounded similar to “softsnack” that was excellent for auditing and recovering passwords. Useful tool to have in case a disgruntled admin started changing root passwords before leaving. Give it a good set of rainbow tables and it’ll probably get you the passwords in a handful of hours. One bit that really makes it easy is the default of an 8-character password length limit in most \*nix systems. Windows 2008 Server makes it a lot harder - the max length there is 128 characters, and I believe you can use Unicode, which takes you from about 40 possible characters to something closer to 100,000 unique characters. The sun may still be shining when you crack that, but assuming the system requires password changes every 60 days, the password you crack will be a few thousand changes ago. [Odds are, it will be 123456.](http://www.tomshardware.com/news/imperva-rockyou-most-common-passwords,9486.html) ---
**Author:** ![JCorre](https://avatars.discourse-cdn.com/v4/letter/j/3da27b/32.png) [@JCorre](https://boards.straightdope.com/u/JCorre)\ **Post date:** [July 16, 2010, 4:08am UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/56 "2010-07-16T04:08:34Z")
Wow! That’s the same password as my luggage! ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [July 16, 2010, 6:50am UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/57 "2010-07-16T06:50:36Z")
> [@](#): > > Odds are, it will be 123456. Note that, even at the #1 spot, that’s still less than 1% of users. It’d still be easy to come up with a practically-usable list that would give you a significant fraction of all passwords, but you’ll need a little more than one try. And what is RockYou, anyway? Is it the sort of thing that people would actually need good passwords for? Because even though I do know about password security, and will use strong passwords when it’s called for, I still use a weak password when there’s not much at stake. ---
**Author:** ![kombatminipig](https://avatars.discourse-cdn.com/v4/letter/k/b5ac83/32.png) [@kombatminipig](https://boards.straightdope.com/u/kombatminipig)\ **Post date:** [July 16, 2010, 8:16am UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/58 "2010-07-16T08:16:07Z")
> [@LouiseE](#): > > For a single hash this is true. However a password file is not a single hash, but contains many entries. The more entries, the better your chance of finding a rainbow table match. Ah yes, too true. That is, if you haven’t bothered salting your hashes. In that case you’re pretty much back to square one. > [@gotpasswords](#): > > Ehhh… Go tell that to my Unix server admins. They crack password files when they’re bored. There used to be a commercially-available application with a name that sounded similar to “softsnack” that was excellent for auditing and recovering passwords. Useful tool to have in case a disgruntled admin started changing root passwords before leaving. > > Give it a good set of rainbow tables and it’ll probably get you the passwords in a handful of hours. One bit that really makes it easy is the default of an 8-character password length limit in most \*nix systems. _gotpasswords_, \*nix systems haven’t been limited to 8 characters for the last decade or so, ever since they dropped DES and wen’t over to MD5 (which is fine for short hashes), or most flavors of SHA if you’re feeling paranoid. Many systems have since time immemorial used Blowfish, which is particularly due to its know strength against rainbow attacks. But seriously, you’re saying that SHA2 has been so seriously compromised? Dear lord, that’s news to me. And the NSA. \*Call the scientists! \* I’ll happily provide a bunch of nicely salted hashes in SHA512 if your sysadmins would like to take a shot. And if your sysadmins are still using DES to hash their passwords, then I say get new sysadmins. > [@LouiseE](#): > > Add to this users’ very common habit of using as passwords their spouse’s name, their kid’s name, their pet’s name, important dates, or dictionary words, and it’s much, much easier to break passwords than non-professionals may realize. That, on the other hand, is an entirely different issue. > [@gotpasswords](#): > > Windows 2008 Server makes it a lot harder - the max length there is 128 characters, You can force users to remember passwords up to 10-12 characters or so (being rather optimistic), but past that you’re back to phrases and post-its. > [@gotpasswords](#): > > and I believe you can use Unicode, which takes you from about 40 possible characters to something closer to 100,000 unique characters. Oooh…explain to me how you’re going to make that work in practice? > [@gotpasswords](#): > > The sun may still be shining when you crack that, but assuming the system requires password changes every 60 days, the password you crack will be a few thousand changes ago. This is of course a question of religion, but I believe that time limited passwords are more of a risk than an advantage. It leads users to either use simpler passwords (because they have to memorize them all anew), or start writing them down on post-its or in notebooks. ---
**Author:** ![crazyjoe](https://avatars.discourse-cdn.com/v4/letter/c/f14d63/32.png) [@crazyjoe](https://boards.straightdope.com/u/crazyjoe)\ **Post date:** [July 16, 2010, 2:13pm UTC](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668/59 "2010-07-16T14:13:47Z")
Hey, any of you security guys want to weigh in on my thread? > **[What is the theory behind this windows security restriction?](https://boards.straightdope.com/sdmb/showthread.php?t=570819)** > > Where I work, I use my normal windows login to do stuff like read my e-mail and enter change orders, but when I need elevated provileges (I’m a DBA) I have to run programs using an alias. When this policy was implemented, I was told that I could... [Previous page](https://boards.straightdope.com/t/the-name-or-password-you-entered-is-not-correct-why-not-narrow-it-down/546668.md?page=2)