Web Security · Junior · Question 56 of 75
Why should a login form say "Invalid email or password" instead of "This email doesn't exist"?
- 1Because shorter messages load faster
- ✓Correct answer: A specific message lets attackers find out which accounts exist (user enumeration)
- 3Because browsers hide specific error messages
Explanation
Knowing which emails are registered helps credential stuffing and phishing. Keep messages and response times similar for both cases.