Contents
Why it is a good idea to display a generic message like invalid username or password?
The reasoning behind this is to prevent someone from trying to brute force your account by ‘guessing’ the password. If the attacker gets an error detailing the password is incorrect, then they could try different passwords until getting it right.
Why does it say username or password is incorrect?
People get the notification about allegedly incorrect info before the Welcome screen. According to Windows enthusiasts, the “The username or password is incorrect” at the login screen occurs due to the enabled “Use my sign in info to automatically finish setting up my device after an update or restart” option.
What does it mean when it says incorrect credentials?
Login failed wrong user credentials
‘Login failed wrong user credentials’ error message means that there is a problem about your credentials (username, password, hotel ID etc.) on the mentioned channel. To resolve this error, you must contact the authorized person on the mentioned channel side to confirm your user details or update them if necessary.
Why do I get a generic error message when my Password is wrong?
One should show a generic message instead, like “Password or username are wrong”. The reason is not to show potential attackers which usernames are already taken, so it’ll be harder to ‘hack’ an existing account. Sounded reasonable for me, but then something different came on my mind.
Do you get an error message if your password is incorrect?
An application should respond with a generic error message regardless of whether the user ID or password was incorrect. It should also give no indication to the status of an existing account. Well, from a different point of view, security-wise, the two messages aren’t much different.
What happens if you enter the wrong password for a different user?
But even if the implementation can distinguish between an nonexistent user and incorrect credentials, you still have the situation where a user enters their password correctly, but the wrong username, and that happens to be a user that exists (with a different password).
Which is error message is better when users entered a wrong?
Well, from a different point of view, security-wise, the two messages aren’t much different. At least for sites that allow registration. The hacker could always go to the registration page and try to register with the said details. Of course, your website, which was initially secured by ambiguity, will straight away shout “that username is taken!”