3 ms·

>Always display a generic message like "Invalid username or password." This prevents attackers from enumerating valid usernames without knowing their passwords.

• axaxs 13y ago
  Not really. If you mean actual password recovery, then I'd consider the site broken anyhow. If you mean password reset - any site worth its salt in security displays the same message regardless. Usually something like "If the account was found, an email will be sent shortly." I ran into one recently that simply said "An email has been sent" regardless of what was entered, which threw me off a bit as I was entering the wrong email address for that site and wondering why I wasn't getting their email....
  • gibybo 13y ago
    How about a registration page instead? Are you going to not tell the user whether the registration worked or not? I've never seen a site that does that. I've seen tons of sites that tell you "invalid username or password" but will happily tell you if the username is registered if you try to register it. It adds no security and just inconveniences users.
    • fabulist 13y ago
      Respectfully, just because hackers can drive a truck through your app doesn't mean they should get to fly a plane, too. Its also easier for your users if you put a CAPTCHA in you registration form rather than your login form. This can mitigate large-scale fishing for usernames. Granted, that hacker who is going after a single poor soul who uses your service won't even feel the speedbump. But s/he is the toughest adversary, and the least common.
• HeyImAlex 13y ago
  Or just trying to register an account? Are you just going to say "that registration may or may not have worked, check your email". I think you should just accept that usernames are public unless your specific instance really needs to hide them.
• balls187 13y ago
  Possibly. Some sites will tell you "Email not on account." I've seen a few that say "We've emailed you instructions on resetting your password."