Re:“Username or password is incorrect” is bullshit
by mnarayan01 on Friday December 22, 2017 @09:45AM
(#15987743)
The point is that sites generally leak this anyway via signup. With github it's even easier, e.g. https://github.com/someuser -- I looked through my settings and their doesn't appear to be any way to "be invisible", though I could be missing something. When you can do a simple query like that, sacrificing UI at sign-in seems totally pointless.
Re:“Username or password is incorrect” is bullshit
by stordoff on Friday December 22, 2017 @09:31AM
(#15987665)
That's the point of the article though - for a large percentage of services, if you know the username/email address you are targeting, you can just try to register them and see if it works. Obfuscating the login process makes little difference.
Re:“Username or password is incorrect” is bullshit
by testvox on Friday December 22, 2017 @10:05AM
(#15987898)
Which is why they shouldn't leak this information on the registration page... Instead they should pretend the registration always succeeds and then disallow login until the email has been verified.
Re:“Username or password is incorrect” is bullshit
by gozur88 on Friday December 22, 2017 @03:10PM
(#15990521)
That works for the email, but not the user name. Going through the entire process and then telling the new user "That one's already taken, please start over" is not going to make people happy.
That’s an easy way to be targeted.