whew
thankfully they redacted the phone nunber
Just good security, nothing to see here.
Being able to determine if a username is valid without a valid password is a security flaw
Even something as simple as taking longer to validate the password when the username is a valid one can also lead to user enumeration
I keep hearing that, yet the websites will gladly tell you that the username is taken when trying to register
I’d assume the spam protection for signing up is a lot tighter than the one for logging in
There are also a lot of websites where you first just enter a username and only when that is valid they ask for a password
Many of those will progress to password even if the user doesn’t exist
And this fucks with password managers as they usually expect both fields on the same page.
Which ones? Both Keeper and KeepassXC will work just fine with it and the latter is FOSS.
It’s called security.
“Wrong username. Correct password.”
“Uh… who’s password?”
I don’t know who is password, or why is password, or when is password, but I do know where is password, and it’s out there!
But… how is password? Secure enough?
