Re:“Username or password is incorrect” is bullshit
by sp332 on Friday December 22, 2017 @10:11AM
(#15987949)
Right, for example if you run an email service, your usernames (addresses) should be hidden. That's because a spammer could use your login page to find valid usernames and then send spam to them. They don't have to guess passwords to cause damage.
[ Parent
| on HN ]
Re:“Username or password is incorrect” is bullshit
by koolba on Friday December 22, 2017 @11:43AM
(#15988751)
They could also use your signup page to attempt to create an account for [email protected]. Since you can't allow duplicates that rejection gives them the same information.
Might as well let a user logging in that the username is incorrect to make the legit use case, i.e. user has a typo and/or misremembers their username, more pleasant.
I usually suggest clearing the username field on failed logins as well. That way if there is a typo, the user doesn't try it again thinking only the password is wrong.
Re:“Username or password is incorrect” is bullshit
by Someone1234 on Friday December 22, 2017 @11:59AM
(#15988905)
Or just use the SMTP specification and or bounce-backs to do the same...