3 ms·
Don't leak whether or not the phone number belongs to an account. All failed login attempts should be some form of "Invalid login" regardless of whether or not
by daenz 4y ago
Don't leak whether or not the phone number belongs to an account. All failed login attempts should be some form of "Invalid login" regardless of whether or not it was an attempt against an actual account or not.
- spiddy 4y agoAlso worth noting that time response deviance when user exists or not can also be a leak of info