39 ms·
How about a registration page instead? Are you going to not tell the user whether the registration worked or not? I've never seen a site that does that. I've s
by gibybo 13y ago
How about a registration page instead? Are you going to not tell the user whether the registration worked or not? I've never seen a site that does that.
I've seen tons of sites that tell you "invalid username or password" but will happily tell you if the username is registered if you try to register it. It adds no security and just inconveniences users.
- fabulist 13y agoRespectfully, just because hackers can drive a truck through your app doesn't mean they should get to fly a plane, too. Its also easier for your users if you put a CAPTCHA in you registration form rather than your login form. This can mitigate large-scale fishing for usernames. Granted, that hacker who is going after a single poor soul who uses your service won't even feel the speedbump. But s/he is the toughest adversary, and the least common.