4 ms·
Revealing user names (As in "you are trying to log in as Luke") is usually considered a security issue, though.
by Tichy 15y ago
Revealing user names (As in "you are trying to log in as Luke") is usually considered a security issue, though.
- phlamb 15y agoThis was my first thought as well. I thought it was bad when it just verified that you had used a correct username after attempting to log in, then I kept reading and saw the auto-complete combobox of usernames...
- trafficlight 15y agoThat combobox was baffling.
- pbreit 15y agoMy first thought was: what about duplicate names?
- trafficlight 15y agoThen it just gives you the available passwords as well. You select the right combination. Easy peasy.
- dunham 15y agoI believe revealing whether or not an email address has an account is also considered a security issue.
- pornel 15y agoValidation on registration form reveals this already.
- subsection1h 15y agoWell-designed registration forms should not reveal this. Our registration forms provide the error "Email address or password is incorrect. Please try again." Further, forgotten password forms, etc. should also not reveal this.
- huhtenberg 15y agoPssst... the registration form, not the login form. As in sorry, we cannot create you an account as your selected username has already been taken.
- itsnotvalid 15y agoas a matter of fact, they don't strictly tell you who the person is with an email address... they just tell you that the email address is taken.
- danellis 15y agoProbably doesn't make much of a difference on those sites that have public profiles, though. They typically have the username in the URL anyway.
- snorkel 15y ago... and not to mention a user privacy violation.
- olefoo 15y agoYes, and in this case the designer made a (hopefully conscious) decision that usability was more important to the user than the information that an attacker would gain. These sorts of decisions are the hard part of building web applications; there's no right answer applicable to all situations, you have to use judgment and experience to gauge how to balance the competing needs of your users and your business.
- huhtenberg 15y agoHow so? Please do elaborate. (edit) In a context of a system that allows anyone to register new account, which appears to be what the linked article focuses on.
- Tichy 15y agoIt's probably a minor issue, but if you can check for existing user names, you have a much easier time trying to find the matching password. Also, it could be a privacy issue (knowing user x is a customer of service y). Showing a photo as well... Of course it depends on the context. On Hacker News all user names are visible anyway.