Security improvement: separate loginID from nickname

https://www.phpbb.com/ideas/
Post Reply
Ideas Bot
Registered User
Posts: 358
Joined: Sat Oct 13, 2012 10:06 am

Security improvement: separate loginID from nickname

Post by Ideas Bot » Mon Mar 24, 2014 8:51 am

What about to separate LoginID from the public Nickname?

I mean, when a new user registers into a website/forum (s)he now has to type the Username and the pass. As every one knows, at the moment the login username is public because is used to identify the author of posts. This could be a security issue imho.

My idea is to implement a new solution like the following:

UserID
Reserved, used to login only. It MUST be different from the Nickname of course.

Password
Reserved, used to login only. No differences from now.

Username | Nickname
Public, that identifies owner posts etc... It MUST be different from the UserID of course.

To check if UserID and Nickname are different an automatic algorithm must check it, in this way is mandatory to be different, without any possibility of mistakes.

IMHO such new schema will double the security in case there is a cracker that tries to discover login credentials using brute force attacks because the attacker has to double his efforts to discover not only the secret pass but the secreted loginID of a certain user.

Also, if a user forgets a password (s)he could attempt a recovery with:
> The email address;
> The public Username|Nickname
> The reserved UserID

So As you can see this idea has two advantages.
Of course the only disadvantage is that users have to remember or take note of one more data.

User avatar
peopleopinion
Registered User
Posts: 372
Joined: Thu Nov 07, 2013 7:12 pm
Contact:

Re: Security improvement: separate loginID from nickname

Post by peopleopinion » Mon Mar 24, 2014 9:08 am

Sorry for double post: because it is not possible to post images directly into the idea post, I posted some images here. Hope this will help to better understand the basic idea.
Attachments
Separation-from-UserID-and-Username (now).png
Separation-from-UserID-and-Username (now).png (1.78 KiB) Viewed 181 times
Separation-from-UserID-and-Username (after).png
Separation-from-UserID-and-Username (after).png (2.42 KiB) Viewed 181 times
Last edited by peopleopinion on Thu Aug 28, 2014 10:48 pm, edited 1 time in total.
Please explicate why you voted negative or positive, so it will be possible to better understand each one's point of view.
Please visit and vote my website and express freely your opinion on it (phpbb ver.: 3.0.12):
http://peopleopinion.altervista.org
Thanks. Best Regards, peopleopinion.

User avatar
Big Mac
Registered User
Posts: 29
Joined: Sun May 27, 2012 11:31 am
Location: London, UK
Name: David Shepheard
Contact:

Re: Security improvement: separate loginID from nickname

Post by Big Mac » Mon May 05, 2014 2:17 pm

I think this should be an option, rather than something that all phpBB forum administrators are forced to implement.

But as an option, it is a great idea.
David "Big Mac" Shepheard

User avatar
John P
Registered User
Posts: 1232
Joined: Mon Jan 21, 2008 3:55 pm
Location: Netherlands
Name: John
Contact:

Re: Security improvement: separate loginID from nickname

Post by John P » Sat Jun 07, 2014 6:58 am

I really like this idea but it should be possible to login with userid or username(nick)

The term userid is not correct I think.
Image
Webhosting, Custom MODs, Technical management, MOD installation and Webdesign

User avatar
Oyabun1
Former Team Member
Posts: 23163
Joined: Sun May 17, 2009 1:05 pm
Location: Australia
Name: Bill

Re: Security improvement: separate loginID from nickname

Post by Oyabun1 » Wed Jun 18, 2014 9:42 am

peopleopinion wrote:UserID
Reserved, used to login only. It MUST be different from the Nickname of course.
Referring to a userID is confusing because phpBB already has a user_id. Using the term login-name may be better.
John P wrote:... but it should be possible to login with userid or username(nick)
Wouldn't that make this change completely pointless since then an attacker wouldn't need to know the login-name in order to login they would simply use the username?

There is a MOD which provides a similar solution to this, Separate Login and User Name
                      Support Request Template
3.0.x: Knowledge Base Styles Support MOD Requests
3.1.x: Knowledge BaseStyles SupportExtension Requests

User avatar
AmigoJack
Registered User
Posts: 4993
Joined: Tue Jun 15, 2010 11:33 am
Location: グリーン ヒル ゾーン
Contact:

Re: Security improvement: separate loginID from nickname

Post by AmigoJack » Sun Jun 22, 2014 6:32 pm

peopleopinion wrote:if a user forgets a password (s)he could attempt a recovery
Passwords can't be recovered.
peopleopinion wrote:with:
> The email address;
> The public Username|Nickname
> The reserved UserID
This increases crackers chances highly. Right now you have to know name and e-mail address. Knowing only one of both/three makes it even easier to get access once they own the e-mail account.


This idea would be better if one has the option to use an alternative display name. But that comes with problems aswell: those names must not collide with existing usernames and other account's display names.
The worst thing about censorship is ███████████

User avatar
callumacrae
Infrastructure Team Member
Infrastructure Team Member
Posts: 2662
Joined: Tue Feb 12, 2008 12:28 pm
Location: London, UK
Name: Callum Macrae
Contact:

Re: Security improvement: separate loginID from nickname

Post by callumacrae » Tue Jul 15, 2014 8:24 am

a) It isn't a security issue
b) People will just choose the same userID and nickname, and will get annoyed if you force them to be different
c) Textbook security through obscurity?
d) Why not just use the email address? It's not public, right? (or it shouldn't be)
macr.ae = my website. you probably won't like it.
Proud user ofProud user of

User avatar
peopleopinion
Registered User
Posts: 372
Joined: Thu Nov 07, 2013 7:12 pm
Contact:

Re: Security improvement: separate loginID from nickname

Post by peopleopinion » Thu Aug 28, 2014 11:42 pm

Oyabun1 wrote:Referring to a userID is confusing because phpBB already has a user_id. Using the term login-name may be better.
Thanks for this suggestion, I'll adopt this line.

John P wrote:I really like this idea but it should be possible to login with userid or username(nick)
The term userid is not correct I think.
I don't agree with this because if it will be possible to use both to login my proposal becomes pointless.
callumacrae wrote: d) Why not just use the email address? It's not public, right? (or it shouldn't be)
I don't agree neither with this because if someone gives his/her email address privately, or pubblicate it somewhere so it is not secreted, in this way my proposal becomes without sense too.

callumacrae wrote: b) People will just choose the same userID and nickname, and will get annoyed if you force them to be different
Well... might be... but the security is improved... and anyway they have to write them just once just when they register, and they have to remember (or write) just the login and the pass that is two words like it is now: now they have to remember (or write) the nick and the pass, so there is not the need for users to use more "memory" in their "brain" than now because they will have two think to remember or write as now is.
callumacrae wrote: c) Textbook security through obscurity?
Sorry I'm ignorant in this matter what's that?


From some responses into the topic it seems to me that my proposal is not completely clear to some responders. Sorry if my English is not perfect. I will try harder to explain its concept better, hoping it helps: at this moment the nickname is used for login and at the same time it appears publically alongside every post so it is universally known.
:arrow: So if a cracker would attempt an attack has to discover only the password because the nick is known. So a brute force attack, for example, will success in a certain time I'll call T1.

My proposal aims to protect all user login data [login name and password] keeping this pair secret and not public. This because my basic idea has:
  1. Only the Username | Nickname public and cannot be used for login;
  2. The loginID | login-name is private and top secret, only the owner knows it, as the password.
:arrow: So with my idea if the cracker attempts to discover the access to the account, has to discover both secret words [login and pass]: discovering a combination of two secret words is pretty more difficult to do than discovering only one. I call this time T2. Because T2 > T1 I think my method is more secure than the one now in use.
Please explicate why you voted negative or positive, so it will be possible to better understand each one's point of view.
Please visit and vote my website and express freely your opinion on it (phpbb ver.: 3.0.12):
http://peopleopinion.altervista.org
Thanks. Best Regards, peopleopinion.

User avatar
AmigoJack
Registered User
Posts: 4993
Joined: Tue Jun 15, 2010 11:33 am
Location: グリーン ヒル ゾーン
Contact:

Re: Security improvement: separate loginID from nickname

Post by AmigoJack » Fri Aug 29, 2014 6:12 am

This results in more or less two passwords: your login-only-but-nowhere-displayed-name is just a second password. This however still needs some kind of collision detection, since they need to be as unique as usernames.
The worst thing about censorship is ███████████

User avatar
peopleopinion
Registered User
Posts: 372
Joined: Thu Nov 07, 2013 7:12 pm
Contact:

Re: Security improvement: separate loginID from nickname

Post by peopleopinion » Tue Jun 16, 2015 3:36 am

AmigoJack wrote:This results in more or less two passwords: your login-only-but-nowhere-displayed-name is just a second password.
More or less yes: it multiply the security because login is secret like the pass and if a cracker tries to gain the access to an account (user or admin), the cracker has to multiply his/her resources and efforts. But to find the right combination of login and pass is pretty more difficult than to find just the pass if the login is the public username.
Also if the owner forget the pass, (s)he can try to reset it using one of these 3 parameters:
Lognid
UserName
Email
This adds a further possibility to reset it before asking admins to do it.

AmigoJack wrote:This however still needs some kind of collision detection, since they need to be as unique as usernames.
This is also true: login could be formed by two parts:
First part chosen by user;
Second part created randomly and checked by the board before showing it to the user that is registering a new account. This way collisions are prevented before they occur.
Please explicate why you voted negative or positive, so it will be possible to better understand each one's point of view.
Please visit and vote my website and express freely your opinion on it (phpbb ver.: 3.0.12):
http://peopleopinion.altervista.org
Thanks. Best Regards, peopleopinion.

Post Reply

Return to “phpBB Ideas”

Who is online

Users browsing this forum: No registered users and 6 guests