4 ms·
Because the application doesn't know what is actually wrong. The error message is actually correct as written. The user entered their username incorrectly or th
by tome 9y ago
Because the application doesn't know what is actually wrong.
The error message is actually correct as written. The user entered their username incorrectly or their password incorrectly, or both. The application doesn’t know which and shouldn’t guess!
- kalleboo 9y agoWhy wouldn't the application know?
- tuxxy 9y agoThe application doesn't know if the username you entered is actually yours or someone else's. You could provide the correct password to your account 'test', but not 'ttest'. The server just tells you to check both instead, it's more semantically correct and offers some security improvements with user enumeration.
- IshKebab 9y agoIt knows if it doesn't exist though. This whole thing is about sites that say "Username or password is wrong" when they know the username is wrong because it doesn't exist!
- tome 9y agoIs it? I thought it was about sites that say "Username or password is wrong" when they know the username does exist! After all, the author is using his own, correct, username in the examples!
- dagw 9y agoWhat if a username does exists, but isn't my username. Imagine both 'dave' and 'davr' have an account. I'm 'dave', but I accidentally type 'davr' and my correct password. Now the site will tell me that my password is wrong. So I retype and retype my password over and over again and still can't log in, because the problem isn't the password like the error message says, but rather that I typed the wrong my username.
- tantanel 9y agoThe message is still not wrong if you think of "or" as the boolean or, not as the boolean xor. The system knows the username is wrong but it doesn't know anything about the password.
- Brinkintrots 9y agoIt's not wrong, it's just not as helpful as it could be.
- bolololo1 9y agoThe application knows unless it some app written by someone who is starting with programming.
- gaius 9y agoHow can it? It passes the pair to some auth API and gets just a yes or a no back.
- chrisper 9y agoIf the application already knows then the person using it is already authenticated.
- endless1234 9y agoIf the username exists, how does the app know whether the user typed the wrong username or password?
- rodorgas 9y agoThis is true for existing user with wrong password, but that message would be wrong if the user doesn't exist. In this case, the error clearly would be the username, not the combination user+pass.
- deleted 9y ago[deleted]
- icebraining 9y agoHow can the pass be correct if the username isn't? A password is only correct in the context of a specific account.
- irishsultan 9y agoThe password may be correct for the user (who is a person, and has a password for that service). Of course the person may have multiple user accounts and he may have given the "wrong" password for the "right" username account, but he may also have given the "right" password for the "wrong" username.