News for hackers. Stuff that matters.

A comment on “Invalid Username or Password”: a useless security measure. Parent comment

Re:“Invalid Username or Password”: a useless security measure by thomastjeffery on Wednesday November 23, 2022 @10:58AM (#33720829)
But in that case, there is still an account (just without login ability), and you are probably even sending an email.

So in the email you can include a link to optional account (username/password) creation.

And if you aren't sending an email, then the user has clearly decided not to create an account.

[ Parent | on HN ]
Re:“Invalid Username or Password”: a useless security measure by layer8 on Wednesday November 23, 2022 @11:29AM (#33721246)
The problem is if an account for that email already exists, see https://news.ycombinator.com/item?id=33720063.
[ Parent | on HN ]