News for hackers. Stuff that matters.
Re:“Username or password is incorrect” is bullshit by irishsultan on Friday December 22, 2017 @08:50AM (#15987363)
It doesn't, so it doesn't know whether your password is incorrect, so if it claims it is incorrect it is saying something it doesn't know for sure.

Also it's technically possible to check the password against all other passwords, it just requires rehashing it for every user in the table, you shouldn't do it obviously.

edit: Even if you would check it, it wouldn't help to answer the question about whether the password or the username is wrong, even if the password is used for a different username you still don't know that it's the right password. So it's a bit strange that it is brought up as an issue that you can't check against other usernames.

There are no comments on this comment yet.