10 ms·

So, given a pair (username, password) that doesn't match the DB, the OP wants the system to magically figure out which one is wrong? What if the user typed a w

• watermelon0 6y ago
  To my understanding, OP just wants websites to not expose any information (existing usernames and emails) to visitors, even in registration forms. What you suggest shouldn't be possible because: - multiple users can have the same password - properly hashed passwords rely on per-user/per-hash random seed, which can be only determined after user is found in the database