I don't think it's safe or even good practice to tell a user specifically what part of my authentication credentials is faulty. I practically guessed my way to my correct username because SO let me know that the username portion of my credentials was incorrect. Then I moved to my password and I guessed my way (until I got tired of it). And SO kept letting me know that it was just my password that was the problem. That is a problem (to me anyway). And there is no lockout policy or anything after several failed attempts. What do you guys think?

  • 7
    I use OpenID, I let Google handle this, I'm not sure I have an opinion on this...
    – Makoto
    Sep 22, 2012 at 4:27
  • Upvoted the question, but at the same time, you're right too @Makoto.
    – d-_-b
    Sep 22, 2012 at 4:46
  • 8
    After all the "make it less strict, dammit, it's just a q&a site" complaints, I find this post refreshing.
    – Shog9
    Sep 22, 2012 at 4:54
  • 4
    @Shog9 There is a fine line between applying common sense and being over-the-top demanding with password requirements. I mean, the requirements do more harm than good. Sep 22, 2012 at 5:22
  • 1
    Realistically what is the risk here for people who aren't actually hunting for their own email address with the password they set? Someone "hacking" their own account in this manner is not exactly a security risk. If someone else knows as much as you do (even if you forget the exact details) you're doomed, regardless of features like this.
    – Ben Brocka
    Sep 22, 2012 at 5:58
  • 2
    @BenBrocka so a brute force attack with the correct username/email as seed information is not possible?
    – kolossus
    Sep 22, 2012 at 5:59
  • Related: Don't tell me which of my credentials is wrong
    – cat
    Mar 22, 2016 at 13:36

3 Answers 3


An error message that tells you if your user name was invalid cannot decrease the security if there are other ways of confirming the existence of a username, such as a public username list, or the registration form rejecting existing usernames.

If those other ways exist, the clearer error message is preferable, since it makes life easier for legitimate users, but doesn't give attackers any additional information.

For SE at least two such channels exist:

  • Rejection of emails already in use ("Protected" by a captcha)
  • Gravatar email hashes (Susceptible to offline brute-force)

Unless both of these channels are eliminated, making the login error message more vague decreases usability without a security gain.

  • If I understand you correctly, with both options, someone who already has my email address cannot repeatedly try a sequence of passwords in an attempt to guess his way into my account (for whatever nefarious purposes)?
    – kolossus
    Sep 23, 2012 at 1:25
  • You seem to misunderstand my concern. Making the login error vague is supposed to deter would be p/w guessers. The current message format DOES give attackers additional information:"Try again, you've the correct email address. Just try some more"
    – kolossus
    Sep 23, 2012 at 1:50
  • I'm not using the SE OpenID provider (which, if I am correct, is what actually is being used in this case). Are you sure the email address in the profile is the same as that used in the SE login?
    – Arjan
    Sep 23, 2012 at 7:31

It's been found that proper error messages significantly reduce login failures. If you don't tell the user their email address isn't even valid they're much more likely to have login failures. This is a significant usability problem.

Security-wise, I don't buy the risk. The true risk comes from:

  • People who already know your credentials (you're screwed)
  • People who have a really damn good idea what your credentials are (you're pretty darn screwed)
  • People who have SE's database (hope you salted your hashes)

This "fix" doesn't realistically prevent any of those attacks. Brute-forcing a password on a known email is still hilariously impractical unless their password was known/obvious, and major hacks that expose large amounts of credentials are done offline with dumps of the database's hashes/plaintext. Being a jerk to users doesn't prevent that.

Also, if you want to kill usability for questionable (at best) security, you'll want to take the ax to this "vulnerability" as well:

enter image description here

As long as account recovery options exist and expose emails, you may as well keep logging in as painless as possible.


What you're describing is less an issue with security and more and issue of privacy. This is one of those times that a good user-experience and good privacy cannot co-exist.

If SO acknowledges that I have entered a correct email but incorrect password, SO can tell me as much and even offer to reset my password. The privacy leak occurs in that any third party can now tell whether or not I am a member of this site by attempting to login with my email.

This is actually pretty important in cases where I may not want to expose that my "professional persona" email is tied to, say, a dating site or a radical political party site. The same really cannot be said for Stack Overflow. It's a Q&A site about technology. In this case I think the improvement in user experience far out-weighs the risk of simply exposing that an email has been used to register, especially since this in no way allows somebody to tie your email to your user or your activities within the site.

  • 1
    I don't understand people and their obsession with privacy. I, for one, am not ashamed of my membership with AtheistFootFetishDating.com and my affiliation with LYIHI, the League of Young IT professionals for Hate and Intolerance.
    – Pekka
    Sep 22, 2012 at 18:37
  • @Pekka When serious about privacy, you need a specialized throw away email. Sep 22, 2012 at 18:39
  • Though I find the first sentence quite bold, I agree with the privacy concern. However, I think it simply applies to SE too.
    – Arjan
    Sep 23, 2012 at 7:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .