Earlier quoted context omitted.
> plenty of people writing auth code will take the stance all failures are presented the same as a bad password or non-existing username Those people would be wrong. You can take all unexpected errors and stick them behind a generic error message like "something went wrong" but you should not lie to your users with your error message.
It's about not leaking sensitive information. If you have different messages for invalid username vs invalid password, you can exploit that to determine if a user has an account at a particular service. "Invalid credentials" for either case solves this problem. But sure, let's report infra failures different as "unexpected error" Now, what happens if the unexpected error is only when checking passwords, but not usern…
Re: Meta outage
#841what if, if one service doesnt respond at all or responds with something that doesnt fit an expected format that it would if working correctly, the whole thing just says "sorry, we had an error, try again later"? if it has to check both at the same time, and cant check them independently, wouldn't that solve the vulnerability? or am i missing something? totally understandable if i am, i just want to learn /gen