4 ms·
Depends on whether the login username is public or not. If you're on a community based site where others can see your username, there's no reason to hide it. A
by dvdhsu 15y ago
Depends on whether the login username is public or not.
If you're on a community based site where others can see your username, there's no reason to hide it. Anybody trying to brute force your password is probably specifically targeting your account.
On the other hand, if you're on a service where other people cannot see your username, it would indeed be better to return a 'username or password does not match' error.
- arank 15y agoMakes sense.
- kwantam 15y agoI don't think the idea is to indicate whether or not the username is correct. No matter what the user enters for the username, when you spit back "username or password incorrect," fill the username with what they typed. A brute force attacker gets no more information than he would with an empty username field because what comes out is identically what he put in, but a real user who mistyped his password knows this immediately by checking the username field and verifying it's correct.