Yeah, the error message could be more helpful:
Wrong password. Try again.
Hint: the correct password isgHI6shTI2!2nd hint: Maybe your have a second account with any of this names: …
3rd hint: their passwords are…
I thought that the implication already was that these accounts have the initially tried password
It could’ve been a random list of accounts with similar passwords
AI slop is great, isn’t it?
yeah real question how would the website even know. Whole point is to match the 2 things together. Is hunter2 my password, well that depends who are you, we’ve got plenty of users that have that hunter2 password
we’ve got plenty of users that have that hunter2 password
Speaking of things the website shouldn’t even know…
Oh it’s ok, my buddy told me lemmy auto censors your password. it shows as a real password to me, but to you guys it’s all stars. Just like in IRC.
In cass it’s not clear from other comments, if the site tells you either one’s wrong but not both, you can then brute force and try out a bunch of usernames and passwords to effectively farm for both: those that say “wrong username” means that the password is valid, while those that say “wrong password” means you got the username that’s in the system.
Once you’ve collected them, the rest is just trying out every password for every user.
So… while this seems weird for a person, it is very much intentional.
Edit after several comments: I don’t know why it’s hard for people to look at the OP, take it for what it is, and argue for the sake of the argument, rather than claiming that something’s impossible because of common or correct technical practices.
those that say “wrong username” means that the password is valid
How could it mean that? The only reason you’d ever say “wrong username” is if the account doesn’t exist (otherwise it’s indistinguishable from “wrong password”) and in that case there’s no reason to even look at the password.
My bigger beef is when I enter the wrong email and it rolls me over to a sign up screen.
Fucker, I have an account, I just don’t remeber which of my 20 email addresses it is.
Cisco VDI took their security to another level. Wrong password? system down? account locked? Always “Please try again later or contact support”.
The absence of details makes the website more secure.
“Something went wrong.”
motherfucker I will OPEN UP THE NETWORK INSPECT TAB AND FIGURE OUT WHAT WENT WRONG.
Network tab: server returned an html page with the words “Something went wrong.”
Classical error code 200
Had manager that wanted us to return error codes on a field of an API response along with an HTTP 200 because “errors bad”. It needed a few of us to make him understand how that worked against common design patterns and you still had to handle error codes since you didn’t know if the error would be coming from the app, web server, api gateway, local network (no internet), etc.
The UPS tracking API has a similar issue, when it doesn’t find a tracking number it returns 200 and an API response with the not found error inside. The documentation even states that the API does return 404 in that case. A github issue about that mismatch is open for over a year already: https://github.com/UPS-API/api-documentation/issues/166
deleted by creator
Wrong username and password combination. Or just wrong credentials.
