31–40 of 289 posts
Yes, but signing up is a more cumbersome process and usually has a CAPTCHA attached to it, unlike logging in.
Earlier quoted context omitted.
The author explains in the article that you're not protected from that case either, as the attacker can try to sign up with your email and find out anyway if that email is already registered.
Many services let you sign up with an existing email and just send a “you tried to sign up, but you seem to have an address already.” to the account owner. In that case it’s indistinguishable for the attacker. Many services already require email confirmation to finalize the signup process so the extra effort is low.
I guess the better point for the article would be "many websites cargo-cult the login error message without understanding why it's there and how that should impact the rest of the service"
But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct. The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.
Unless the site searches to find out which username the entered password actually corresponds to (which is a whole new, terribly dangerous, can of worms), it can't do better than that
Because any malicious player can easily check whether usernames exist, so hiding that data point is not much good for security.
Great. Now I can’t share passwords any more with significant others. Instead I have to send them login credentials every time they want to login.
But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct. The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.
Quoted post unavailable.
But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct. The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.
You can provide a more helpful error message by explicitly informing the user that the username they typed exists but they haven't offered the correct password for it. Unless the site searches to find out which username the entered password actually corresponds to (which is a whole new, terribly dangerous, can of worms), it can't do better than that Because any malicious player can easily check whether usernames exis…
I'd say it's wrong to assume it's even a security measure. I'm fairly sure it goes like this if (db->query("SELECT * FROM `users` WHERE `email` = 'yesthisisdog@gmail.com' AND `password` = MD5('hunter2')") { login(username); } else { error('invalid username or password'); } with nobody giving it a second thought.
But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct. The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.
You can provide a more helpful error message by explicitly informing the user that the username they typed exists but they haven't offered the correct password for it. Unless the site searches to find out which username the entered password actually corresponds to (which is a whole new, terribly dangerous, can of worms), it can't do better than that Because any malicious player can easily check whether usernames exis…
The parent poster already addressed that though:
“If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct.”
If you inform the user the username they typed exists, the chance of them not thinking about double-checking they didn’t mistype their own username increases.