I'm going to kill all of you
-
[email protected]replied to [email protected] last edited by
It's frustrating but it does give information to attackers. If an attacker just sees the login attempt was rejected, then they have no idea if it was because the password changed, the user entered it wrong in the phishing form, the user realized it was a phishing attempt and gave garbage to fuck with them, the password expired, or if the service provider is on to them.
If an attacker sees "your password has been reset and you must set a new one" then they have some information that could be used to social engineer their way into the account. Especially if it's a work account where the email is behind the same password.
-
My old job did this.
"Oh Monkeybutthair01,02,03 has already been used....Monkeybutthair04 it is."
password updatedSECURITY.
-
I've once had a user who managed to add a second keyboard layout by accident and switch to it on login. I found out when I reset his password and it still didn't work on the laptop of the users even if I typed it in myself.
-
Don't get me started on captchas
-
[email protected]replied to [email protected] last edited by
It's actually impossible to detect someone doing this without storing passwords in plaintext, which is incredibly insecure.