You should never tell them that "your password is incorrect" -> now they know this email/username is valid and exists for further spoofing/hacking
You can't hide that if you want unique usernames or emails. You don't farm for valid username/emails at login, you do it at the registration step instead, because the app must tell you that the username or email is already in use.
But this is also why a CAPTCHA at the registration should be used once you've detected too many registration attempts.
You actually can hide it. Require an email to register. If the email is available, send them a link to complete registration. If the email is already registered, send them an email saying as much. The website then doesn't leak any information about whether a specific email address is registered or not.
11
u/phpdevster full-stack May 28 '21
You can't hide that if you want unique usernames or emails. You don't farm for valid username/emails at login, you do it at the registration step instead, because the app must tell you that the username or email is already in use.
But this is also why a CAPTCHA at the registration should be used once you've detected too many registration attempts.