Question

I am designing a basic website which access is restricted by a classic login & password system.

I can’t decide whether I should show a different message when the user enters a non-existing login, and when he enters an invalid password for an existing account.

My first intuition would be not to show a different message, because that would give hints to potential attackers about what is wrong but doing so would sometimes makes more difficult for the user to understand his errors (perhaps he just mistyped his account login and an appropriate error message would be better). On another hand, I often heard that the account login was not a secret (as the password obivously is) and so giving information about it should not lower the security level.

Do you guys have any good practice/rationale that I should follow regarding this ?

Thanks.

Answer 1

Don’t differentiate these – it is information that can be used by malicious parties.

If they know a username is right, they already have valuable information that you have leaked.

It is a minor inconvenience to your users why exactly the login failed, they still have to enter both username and password, after all.