One way this happened to me was because the ” choose password” page silently truncated too long passwords. The login page didn’t truncate.
deleted by creator
They keep multiple old passwords. You’ve done this whole stick before and you tried to use that same password last time. You use it for everything, and every time your new account gets “hacked.” You keep using that password even when we show you that it’s been in multiple leeks and is associated with your email.
“But I like the password, it’s my favourite football team!”
That’s because you’ve been rate limited trying passwords for an hour. When an attacker is randomly trying incorrect passwords, even the correct password will be rejected. Otherwise the protection wouldn’t be very useful.
Had a convo with someone a while back:
Bug report: “The ‘reset password’ form doesn’t show an error if you try to reset an account that doesn’t exist.”
Me: “That would be a security risk. Closed.”
Them: “What? How? You have to click the link in the email before it does anything.”
Me: “Try putting in a bogus email on the login screen. See how it says ‘wrong email/password combination’, and not ‘no such account’? If we tell the user whether we recognize a given email, we’re basically providing attackers a list of users they can try passwords for.”
But then there would be no harm in just stating the rate limit :(
There’s few things more violently infuriating than being told that… You fucking told me it was the wrong password in the first place for fuck sake, I only have 3 fucking password variants I use, but noooo you need a brand new, never before used by any human ever, password. Fuck you web developers!
I only have 3 fucking password variants I use
I used to live that life. It’s a dangerous one. Consider a password manager.
I’ve always thought that the best password security possible would be to always have the real password fail a few times. People who know their password will keep trying it, someone else will try a different one. It’s a variation of not giving an error that tells what failed.
This is delightfully evil
