3 ms·

Ask HN: Why can’t every webpage show the password requirements if entered wrong?

• newsbinator 5y ago
  That would be helping the hackers, by saving them the 10 ~ 90 seconds at the start of their session it would take to determine the password requirements manually.
  • rolph 5y ago
    very often when you create a new account there are very often restrictions or arbitrary properties that reduce the number of brute force combinations required and provide a set of rules to generate a password the user has to know what the password rules are, the hacker doesnt but when it does it has less work to do. i dont know how we might separate the twain other than limiting creation and trial of passwords
    • deleted 5y ago
      [deleted]
• 247hustler 5y ago
  Security reasons, the more ambiguous you can keep it, the better it is for keeping bad actors away. Same reason almost all sites don't tell you whether it's the email or password that was wrong when you create an invalid login attempt.