4 ms·
But if usernames are released publicly in forums, google crawled pages etc, then an attacker already knows the existence of a subset of the accounts at least.
by polymatter 13y ago
But if usernames are released publicly in forums, google crawled pages etc, then an attacker already knows the existence of a subset of the accounts at least.
For example, somebody attacking HN can crawl pages such as this one and determine that 'skeletonjelly' is a valid HN user.
- skeletonjelly 13y agoSure, but I guess there's no one single security model that fits all situations. I guess that's what I meant by "best practice". Obviously internet banking usernames wouldn't be listed somewhere public