2 ms·

I'd prefer the error to be "invalid username" if the typed username is not registered, and "wrong username or password" if it is. The system only knows if the u

by tromp 4y ago

I'd prefer the error to be "invalid username" if the typed username is not registered, and "wrong username or password" if it is. The system only knows if the username is valid or not; it doesn't know whether it's wrong (i.e. mistyped).

kahrl 4y ago
I'd prefer to not create brute force vulnerability that leaks the site's list of user email addresses to an attacker.
- tromp 4y ago
  As the article points out, this leaks it no more than trying to register an email address.
  - croes 4y ago
    Which can be prevented by sending an confirmation email at a signup, no matter if a new account or an existing one.