Re:Techniques To Simplify Sign-Ups and Log-Ins
by kwantam on Thursday May 05, 2011 @12:28PM
(#2517939)
I don't think the idea is to indicate whether or not the username is correct. No matter what the user enters for the username, when you spit back "username or password incorrect," fill the username with what they typed. A brute force attacker gets no more information than he would with an empty username field because what comes out is identically what he put in, but a real user who mistyped his password knows this immediately by checking the username field and verifying it's correct.
If you're on a community based site where others can see your username, there's no reason to hide it. Anybody trying to brute force your password is probably specifically targeting your account.
On the other hand, if you're on a service where other people cannot see your username, it would indeed be better to return a 'username or password does not match' error.