News for hackers. Stuff that matters.

A comment on “Invalid Username or Password”: a useless security measure. Parent comment

Re:“Invalid Username or Password”: a useless security measure by gchamonlive on Wednesday November 23, 2022 @10:38AM (#33720499)
The flow is

1. Sign up for an account 2. Enter the email 3. Receive a confirmation email 4. Create password 5. Sign in

This is what op means. You just ingest step 2 without confirming the email is used or not. The actual account creation should occur only after email confirmation.

[ Parent | on HN ]
Re:“Invalid Username or Password”: a useless security measure by thefreeman on Wednesday November 23, 2022 @10:43AM (#33720575)
Gotcha. That does make more sense and basically signup and reset password are essentially the same process. If the user doesn't have an account previously at that point you collect the information needed to proceed. I personally would not want to break up my onboarding experience like this but I can see other people making the trade off.
[ Parent | on HN ]