News for hackers. Stuff that matters.
Re:“Invalid Username or Password”: a useless security measure by swhitf on Wednesday November 23, 2022 @09:25AM (#33719466)
Usually it is to detect the user is registered to (or their domain is mapped to) an account with SSO or Social Auth and prompt them for that login mechanism. If the user is being required to go via the SSO provider, it makes sense to ask for the email first before they input their password so that they can be redirected it neccesary.

There are no comments on this comment yet.