“Invalid Username or Password”: a useless security measure

Re:“Invalid Username or Password”: a useless security measure by layer8 on Wednesday November 23, 2022 @10:26AM (#33720335)

This is commonly the case for online shopping, where account creation is optional and may only occur after confirmation, but the order will be placed regardless.

[ Parent | on HN ]

Re:“Invalid Username or Password”: a useless security measure by darrinmn on Wednesday November 23, 2022 @10:56AM (#33720792)

See my comment https://news.ycombinator.com/item?id=33720405

[ Parent | on HN ]

Re:“Invalid Username or Password”: a useless security measure by thomastjeffery on Wednesday November 23, 2022 @10:58AM (#33720829)

But in that case, there is still an account (just without login ability), and you are probably even sending an email.

So in the email you can include a link to optional account (username/password) creation.

And if you aren't sending an email, then the user has clearly decided not to create an account.

[ Parent | on HN ]

Re:“Invalid Username or Password”: a useless security measure by layer8 on Wednesday November 23, 2022 @11:29AM (#33721246)

The problem is if an account for that email already exists, see https://news.ycombinator.com/item?id=33720063.

[ Parent | on HN ]