4 ms·

I never really understood the reasoning behind the whole "maybe your email or password is wrong - but we wont tell you which" message that websites love to give

I never really understood the reasoning behind the whole "maybe your email or password is wrong - but we wont tell you which" message that websites love to give. The reasoning tends to be along the lines of "prevent spammers getting emails" and "security by obfuscation". But almost all these websites have a sign up page, and if the email address is already in use they will happily let you know that. Therefore if a hacker/spammer/bad guy wants to brute force your application for emails - they can just use the 'sign up' page to get the emails instead of the 'forgot password' page.

unfortunateface 12y ago
I would argue that registration pages should not let someone know if an email is in use - if a duplicate email is used in registration then the site should just send a quick email notifying the user that this email is already in use (with sensible DOS protection and email opt-outs etc.) Your use-cases miss out one type of hacker/spammer/bad guy - the one who is only looking for you, they know your email, they want to profile you specifically. Over the top/exaggerated example (with many implicit caviats!)... Mr Smith has Mrs Smiths email - he uses it to try to register with a Dating Website - but hold on, it's already registered! Now there could be 3 reasons for this... 1. infidelity 2. It pre-dates the relationship 3. A third party trying to cause trouble by signing Mrs Smith up. I don't believe a company has the right to decide what data they hold on you is visible to the outside world - without expressly asking you.
- maaarghk 12y ago
  What happens on the front end in that case? Would it be an irritating "Please check your email to continue registration" kind of situation? Because people don't like that as of 2010 ish
  - sp332 12y ago
    Yeah, I've gotten that recently. It's not that annoying, since you're going to have to validate your email address at some point anyway.
  - unfortunateface 12y ago
    What sp332 said - there wouldn't be any extra steps as you would have to go to your email to complete registration anyhow. You could have an extra link in your email which lets you update your existing registration details with the ones you've just entered, but that's not going to significantly extend the amount of time you take to register.
kibwen 12y ago
There does exist a legitimate (though contrived) use case for not telling the user which of the fields is wrong: when a user misspells their username and that misspelled username belongs to another user. From the user's point of view the username would be wrong but the password would be right, whereas from the site's perspective this is reversed and would produce an incorrect error message. This particular case would be particularly insidious because it's impossible to review a password after typing it. Like I said, contrived, but security-by-obfuscation isn't necessarily the sole motivation (though likely the commonest).
totony 12y ago
The code needed to track the error is slightly bigger if you need to know what causes the error. Stating what is wrong at login has no apparent added benefit and has a slight disadvantage.

unfortunateface 12y ago

I would argue that registration pages should not let someone know if an email is in use - if a duplicate email is used in registration then the site should just send a quick email notifying the user that this email is already in use (with sensible DOS protection and email opt-outs etc.) Your use-cases miss out one type of hacker/spammer/bad guy - the one who is only looking for you, they know your email, they want to profile you specifically. Over the top/exaggerated example (with many implicit caviats!)... Mr Smith has Mrs Smiths email - he uses it to try to register with a Dating Website - but hold on, it's already registered! Now there could be 3 reasons for this... 1. infidelity 2. It pre-dates the relationship 3. A third party trying to cause trouble by signing Mrs Smith up. I don't believe a company has the right to decide what data they hold on you is visible to the outside world - without expressly asking you.

maaarghk 12y ago
What happens on the front end in that case? Would it be an irritating "Please check your email to continue registration" kind of situation? Because people don't like that as of 2010 ish
- sp332 12y ago
  Yeah, I've gotten that recently. It's not that annoying, since you're going to have to validate your email address at some point anyway.
- unfortunateface 12y ago
  What sp332 said - there wouldn't be any extra steps as you would have to go to your email to complete registration anyhow. You could have an extra link in your email which lets you update your existing registration details with the ones you've just entered, but that's not going to significantly extend the amount of time you take to register.

kibwen 12y ago

There does exist a legitimate (though contrived) use case for not telling the user which of the fields is wrong: when a user misspells their username and that misspelled username belongs to another user. From the user's point of view the username would be wrong but the password would be right, whereas from the site's perspective this is reversed and would produce an incorrect error message. This particular case would be particularly insidious because it's impossible to review a password after typing it. Like I said, contrived, but security-by-obfuscation isn't necessarily the sole motivation (though likely the commonest).

totony 12y ago

The code needed to track the error is slightly bigger if you need to know what causes the error. Stating what is wrong at login has no apparent added benefit and has a slight disadvantage.