2 ms·
Telling them "correct password, wrong email" seems like a bit of an information leak if you ask me. I think a "did you mean?" output in case of a bad password
by andrewstuart2 12y ago
Telling them "correct password, wrong email" seems like a bit of an information leak if you ask me.
I think a "did you mean?" output in case of a bad password as long as there are lexically similar usernames in the database.
- masklinn 12y agoIgnoring the fact that doing that would be retarded, if you're following modern practices and hashing passwords with KDFs that's not really possible without killing your server.
- andrewstuart2 12y agoSorry, should have added a :-P to indicate my sarcasm.