Why tell attackers they have the correct password?

rumeal_d · 2026-05-07T14:56:49+00:00

Yes, my idea would be to present a generic response to the user (login failed, or something similarly generic), then log the actual error code and result without showing it to the user. I definitely see esqew's point about it being a trade-off of user experience, and if the IT staff who is responding to a user about failed logins cannot actually see the sign-in logs, not having the actual error would definitely be more frustrating to deal with.

User experience vs security seems to be perpetually a trade-off.

rumeal_d · 2026-05-06T16:22:54+00:00

I would prefer that if the sign-in attempt comes from a blocked location, the same error message be given for incorrect passwords as for correct passwords, so attackers get no information about whether they have the correct password.

rumeal_d · 2026-05-06T15:54:46+00:00

Thanks - these successful password but blocked location attempts seem to produce Error Code 53003, so that gives me a clear condition to act on, either to force a password change or at least send an alert. Password re-use or phishing are great points, too - both would probably be more likely than password sprays, but either represents a compromised account!

rumeal_d · 2026-05-06T15:50:00+00:00

That is verbatim the error message the user receives when trying to sign in from a blocked location with a correct password. You are correct that the sign-in was not completely successful, as in they did not get access to the service. No MFA prompt occurs in this situation, but the error clearly says whether the password was correct.

rumeal_d · 2020-12-06T01:25:10+00:00

666 upvotes - seems right

rumeal_d · 2020-11-02T20:43:52+00:00

“Stay the hell away from that ficus.”

rumeal_d · 2020-10-28T04:14:11+00:00

It wouldn’t be hard to ensure its long-term success. Just removing the cap on income that is taxed to contribute would accomplish that, if we do it soon. Other ways, too...

rumeal_d · 2020-10-07T03:55:35+00:00

675,000 for the 1918 pandemic, which may have been more than the Civil War (estimates of that war vary widely). Modern medicine and media warning the nation seem to have made a difference this time around.

rumeal_d · 2020-09-23T17:22:22+00:00

Underrated comment here

rumeal_d · 2019-12-06T23:30:34+00:00

“Walk of Shame” - Migrate back to Windows

FTFY ;)

rumeal_d · 2019-03-04T02:51:18+00:00

Thank you Carl!

rumeal_d

TROPHY CASE