Hacker News Reader

I'd prefer the error to be "invalid username" if the typed username is not registered, and "wrong username or password" if it is. The system only knows if the username is valid or not; it doesn't know whether it's wrong (i.e. mistyped).

View on HN

I'd prefer to not create brute force vulnerability that leaks the site's list of user email addresses to an attacker.

As the article points out, this leaks it no more than trying to register an email address.

Which can be prevented by sending an confirmation email at a signup, no matter if a new account or an existing one.

Reply on news.ycombinator.com