2 ms·
Well you can at least inform the user that the username is incorrect if there is no user by that name.
by Houshalter 12y ago
Well you can at least inform the user that the username is incorrect if there is no user by that name.
- Coding_Cat 12y agoYou would still have the issues described in the OP. If it says "username incorrect" only when that user does not exist, you can still figure out a username by just trying them with a random password. If you get told "password incorrect" you know the username you just tried already exists.
- Houshalter 12y agoWhy is that an issue? You can also do that by trying to create accounts.