It's hilarious how all OP did with this post is show everyone how dumb they are.
Seriously, how do you NOT understand the security risk of that?
this post was submitted on 10 Apr 2026
427 points (91.0% liked)
Programmer Humor
30886 readers
1255 users here now
Welcome to Programmer Humor!
This is a place where you can post jokes, memes, humor, etc. related to programming!
For sharing awful code theres also Programming Horror.
Rules
- Keep content in english
- No advertisements
- Posts must be related to programming or programmer topics
founded 2 years ago
MODERATORS
I remember there was a joke about this back in the day were someone put a joke error message saying: "that password belongs to ninja123, please enter your password"
Cisco VDI took their security to another level. Wrong password? system down? account locked? Always "Please try again later or contact support".
Being able to determine if a username is valid without a valid password is a security flaw
Even something as simple as taking longer to validate the password when the username is a valid one can also lead to user enumeration
I keep hearing that, yet the websites will gladly tell you that the username is taken when trying to register
I'd assume the spam protection for signing up is a lot tighter than the one for logging in
There are also a lot of websites where you first just enter a username and only when that is valid they ask for a password
load more comments
(1 replies)
I was having a chat about this with a UX guy. His argument for using a similar flow was that the username/email will have to be validated at the point of registration anyway so you might as well make it easier for the user when the email is wrong. I couldn't really refute this logic.
If you throttle both login and registration, then surely the risk is minimised while keeping the user happy?
You see the registration problem in so many places. If the username is an email, the proper way to validate it without revealing if an account exists is to accept any email address and if it already exists say that in the registration email you would send anyway. With the appropriate throttling if needed.
Compared to login or password reset, you rarely see the email validate before register flow, especially for mobile apps etc. That makes it pretty hard to make the case that this needs to be actioned from a security perspective when even the big companies are not following it either.
load more comments
(1 replies)
Stuff like this is why you need to understand the reasons why, and not just the actions to do something.
whew
thankfully they redacted the phone nunber
It's called security.
"Wrong username. Correct password."
"Uh.... who's password?"
Error: password already in use by CobainKiller94
I don’t know who is password, or why is password, or when is password, but I do know where is password, and it’s out there!
load more comments
(1 replies)
load more comments
(13 replies)
Just good security, nothing to see here.
Any further "helpful" information in that error message would be a security issue.
I am annoyed by (but respect) APIs that take it a level further and don't even give you a 403 to say you're unauthorised, they just give you a 404 because anything else would acknowledge that the resource you requested actually existed
I don't respect them because most instances a 403 is more than adequate for your security. The only time I agree with having a 404 over a 403 would be file-specific pathing, but realistically the entire file directory should be a 403 instead of a 404, And then if the user is authorized to access the resource(but it isn't there), then it gives a 404.
But if there is no resource, how can the system know whether they are authorized? 403 it is.
Whether you respond as a 404 or a 403 would be dependent on whether or not the user who is logged in has the authorization to read the previous directory.
A site administrator, for example, would have the authority to read the previous directory, which means that the site administrator would know whether or not the resource existed or not(as the previous directory would list it) so in which case a 404 would be proper. However, a user who doesn't have authority to read the previous directory should not have the ability to know whether or not it exists. so a 404 would not be proper here because the proper one would be a 403 because it's inherited from the previous directory.
edit: changed traverse to read, as traversal doesn't mean you can see what else is there.
load more comments
(1 replies)
Wouldn't unauthorized only be meant for AFTER a login is successful?
Like, the user should have to have an active session first. Maybe you're just talking about that case though.
load more comments
(2 replies)
load more comments
(2 replies)
Yeah, the error message could be more helpful:
Wrong password. Try again.
Hint: the correct password isgHI6shTI2!
load more comments
(6 replies)
try all passowrds. Fail
Maybe I don't have an account...
create new account. email already in use. Fail.
Okay, guess I'll reset the password through email.
password can't be one already used. Fail
WHAT?!
load more comments
(1 replies)
Website: Wrong user name or password.
Me: Password.
Website: Correct! Come right in.
My bigger beef is when I enter the wrong email and it rolls me over to a sign up screen.
Fucker, I have an account, I just don't remeber which of my 20 email addresses it is.
view more: next ›