Hacker News Reader

Comment by tome | Hacker News Reader

Because the application doesn't know what is actually wrong. The error message is actually correct as written. The user entered their username incorrectly or their password incorrectly, or both. The application doesn’t know which and shouldn’t guess!

View on HN

This is true for existing user with wrong password, but that message would be wrong if the user doesn't exist. In this case, the error clearly would be the username, not the combination user+pass.

How can the pass be correct if the username isn't? A password is only correct in the context of a specific account.

The password may be correct for the user (who is a person, and has a password for that service).

Of course the person may have multiple user accounts and he may have given the "wrong" password for the "right" username account, but he may also have given the "right" password for the "wrong" username.

Why wouldn't the application know?

The application doesn't know if the username you entered is actually yours or someone else's.

You could provide the correct password to your account 'test', but not 'ttest'.

The server just tells you to check both instead, it's more semantically correct and offers some security improvements with user enumeration.

It knows if it doesn't exist though. This whole thing is about sites that say "Username or password is wrong" when they know the username is wrong because it doesn't exist!

What if a username does exists, but isn't my username.

Imagine both 'dave' and 'davr' have an account. I'm 'dave', but I accidentally type 'davr' and my correct password. Now the site will tell me that my password is wrong. So I retype and retype my password over and over again and still can't log in, because the problem isn't the password like the error message says, but rather that I typed the wrong my username.

Is it? I thought it was about sites that say "Username or password is wrong" when they know the username does exist! After all, the author is using his own, correct, username in the examples!

The message is still not wrong if you think of "or" as the boolean or, not as the boolean xor. The system knows the username is wrong but it doesn't know anything about the password.

It's not wrong, it's just not as helpful as it could be.

Reply on news.ycombinator.com