1313

LESSWRONG
LW

1312
Personal Blog

6

META: Misleading error message on using wrong username

by RolfAndreassen
27th Nov 2010
1 min read
3

6

Personal Blog

6

META: Misleading error message on using wrong username
3wnoise
1David_Allen
5Vladimir_Nesov
New Comment
3 comments, sorted by
top scoring
Click to highlight new comments since: Today at 1:06 AM
[-]wnoise15y30

There are (mild) security reasons to not let attackers know if the username is valid or not. It's pretty useless here as /user// will reveal this. In other contexts, the message typically acknowledge the possibility with "incorrect password or username".

Reply
[-]David_Allen15y10

If you look at the bottom of the page you will see a Report Issues link.

Reply
[-]Vladimir_Nesov15y50

The link leads to a page which previously linked to the bug tracker, but on 19th October 2010 someone edited it, so the link was lost. I restored the content of that page, it points to bug tracker again now.

Reply
Moderation Log
More from RolfAndreassen
View more
Curated and popular this week
3Comments

I attempted to log in from a computer I don't usually use, and entered my username as "Rolf Andreassen", two words; in fact it's "RolfAndreassen", one word. The error message I got back was "Incorrect password", which is misleading. Not until I tried to recover my password did I realise my mistake. Clearly this is an unusual edge case, but I suggest updating the code to give back "No such user" when someone makes this mistake.