“Username or password is incorrect” is bullshit

Re:“Username or password is incorrect” is bullshit by ivanbakel on Friday December 22, 2017 @08:14AM (#15987169)

I'm not sure the point made was as much "use this blanket solution" as "if you're aiming to do this, go all the way".

Obviously, Github and Stripe aren't actually enforcing these messages as part of some larger security policy, or if they are, they're doing it very poorly. But if they were, the email shuffle is what they ought to be doing.

[ Parent | on HN ]

Re:“Username or password is incorrect” is bullshit by travisjeffery on Friday December 22, 2017 @08:26AM (#15987229)

You got it. You can be about security or UX. And when the accounts are public I'm especially in favor of taking advantage UX-wise. The issue's when both are half-assed.

[ Parent | on HN ]