[From-Scratch] Coded forum - (PHP/MySQL)

[Charles Stover]

Dec 27, 2009 9:09:37 GMT -8 RedBassett said:

Common suggestion:

Do not tell someone when they (fail to) login if it is the username or password that they have wrong. This makes it easier to guess at the login, especially under some circumstances.

I disagree. Knowing that it's the wrong username is a useful feature, since some people tend to use multiple usernames across the Internet. I myself have been baffled by how none of my passwords work, and it turned out I was using the wrong username. Assuming you're talking about brute-forcers and the like, someone's username will likely be already determined as accurate (e.g. pulled from a member list or somewhere else on the site where it is listed) before it is attempted to be cracked - so a "wrong password" is implied. The only people who will be affected by a "wrong username" screen are those who will need it.

[RedBassett]

Dec 27, 2009 12:41:55 GMT -8 Charles Stover said:

Dec 27, 2009 9:09:37 GMT -8 RedBassett said:

Common suggestion:

Do not tell someone when they (fail to) login if it is the username or password that they have wrong. This makes it easier to guess at the login, especially under some circumstances.

I disagree. Knowing that it's the wrong username is a useful feature, since some people tend to use multiple usernames across the Internet. I myself have been baffled by how none of my passwords work, and it turned out I was using the wrong username. Assuming you're talking about brute-forcers and the like, someone's username will likely be already determined as accurate (e.g. pulled from a member list or somewhere else on the site where it is listed) before it is attempted to be cracked - so a "wrong password" is implied. The only people who will be affected by a "wrong username" screen are those who will need it.

I have always made no distinction between the two, but it is a matter of the programmer's opinion. I prefer the slight security benifits, and am simply echoing a suggestion that has been made to me many times before, but as I said, this is a matter of personal taste.

[Phrate]

The reason for the exploits not being removed is because I am working on ToT v2.