<story><title>“Username or password is incorrect” is bullshit</title><url>https://hackernoon.com/username-or-password-is-incorrect-is-bullshit-89985ca2be48</url></story><parent_chain><item><author>cdancette</author><text>Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public.&lt;p&gt;So for login: always say &amp;quot;email or password is incorrect&amp;quot;.&lt;p&gt;And for register: as he said, always say &amp;quot;we sent you an email to verify your email&amp;quot;.</text></item></parent_chain><comment><author>ryanbrunner</author><text>If you have a user name, why do you care about e-mail? Let people enter an arbitrary user name, and log in with that. Username enumeration doesn&amp;#x27;t carry privacy concerns since users can ensure their usernames don&amp;#x27;t reveal personal information. For duplicate e-mails on signup, who cares? Since you&amp;#x27;re not using them as an identifier, let multiple users have the same e-mail address.&lt;p&gt;Making your validation errors cross mediums and a wait for an e-mail to delivered is an unnecessarily hostile user experience.</text></comment>
<story><title>“Username or password is incorrect” is bullshit</title><url>https://hackernoon.com/username-or-password-is-incorrect-is-bullshit-89985ca2be48</url></story><parent_chain><item><author>cdancette</author><text>Signup and login should behave the same, and provide no information wether the email is registered or not. And username should be treated as public.&lt;p&gt;So for login: always say &amp;quot;email or password is incorrect&amp;quot;.&lt;p&gt;And for register: as he said, always say &amp;quot;we sent you an email to verify your email&amp;quot;.</text></item></parent_chain><comment><author>bo1024</author><text>Why? I don&amp;#x27;t see why it&amp;#x27;s important to hide existence of a user unless you&amp;#x27;re allowing people to try multiple logins per second on your site. (I&amp;#x27;m not an expert so I am sincerely asking to help me understand.)</text></comment>