News for hackers. Stuff that matters.
Re:“Username or password is incorrect” is bullshit by chc on Friday December 22, 2017 @11:03AM (#15988381)
I think you're confusing "correct" and "exists" or "was entered deliberately." A password can only be correct or not for a given account. If the password differs from the one recorded for the user you specified, it is incorrect. It doesn't matter if there's some other place where that password does exist.

A system that used an "existence" or "user intended to type this" concept of password correctness would be either unimplementable or insecure to the point of uselessness.

There are no comments on this comment yet.