“Invalid email or password.” Really?

Re:“Invalid email or password.” Really? by merty on Sunday October 14, 2012 @02:42PM (#4652160)

I knew someone would say this :)

This is not an excuse for most of the sites (including Codecademy) because when you follow the "Forgot password" link and type in an email address, they instantly tell you whether that email address exists or not.

If you are displaying a message such as: "If the email address you provided is registered, you will receive an email shortly." then fine :)

[ Parent | on HN ]

Re:“Invalid email or password.” Really? by gingerlime on Monday October 15, 2012 @02:55AM (#4654027)

Very good point. This should be mentioned on the blog post too, and maybe brought to the attention of the site owners. It definitely makes a stronger case for either:

* avoiding giving away this piece of information on the forgot password screen

* telling the user whether it's their password or username that is wrong.

You might want to take a look at this security stackexchange question http://security.stackexchange.com/q/13079/7306

update: I noticed this was in fact mentioned on / added to the blog post.

[ Parent | on HN ]