Tweeted twitter.com/StackSecurity/status/870154642629459969
3 Formatting the bold
source | link

On Code Review stack exchange, in response to code that informs the user when their login attempt failed because of too many login attempts from an IP, I was told

"Absolutely do not message end user telling them why login failed. You are giving a potential attacker critical information to aid them in attacking you application. Here you give an attacker very precise information to get around your IP restriction."

https://codereview.stackexchange.com/a/164608/93616

Am I practicing bad security? Should I explain in more vague terms like "Too many login attempts" or "You could not be logged in"?

**UpdateUpdate: ** In case there's any ambiguity, currently the too many attempts logic and message does not care if the attempts were successful or not.

On Code Review stack exchange, in response to code that informs the user when their login attempt failed because of too many login attempts from an IP, I was told

"Absolutely do not message end user telling them why login failed. You are giving a potential attacker critical information to aid them in attacking you application. Here you give an attacker very precise information to get around your IP restriction."

https://codereview.stackexchange.com/a/164608/93616

Am I practicing bad security? Should I explain in more vague terms like "Too many login attempts" or "You could not be logged in"?

**Update: ** In case there's any ambiguity, currently the too many attempts logic and message does not care if the attempts were successful or not.

On Code Review stack exchange, in response to code that informs the user when their login attempt failed because of too many login attempts from an IP, I was told

"Absolutely do not message end user telling them why login failed. You are giving a potential attacker critical information to aid them in attacking you application. Here you give an attacker very precise information to get around your IP restriction."

https://codereview.stackexchange.com/a/164608/93616

Am I practicing bad security? Should I explain in more vague terms like "Too many login attempts" or "You could not be logged in"?

Update: In case there's any ambiguity, currently the too many attempts logic and message does not care if the attempts were successful or not.

2 Clear ambiguity
source | link

On Code Review stack exchange, in response to code that informs the user when their login attempt failed because of too many login attempts from an IP, I was told

"Absolutely do not message end user telling them why login failed. You are giving a potential attacker critical information to aid them in attacking you application. Here you give an attacker very precise information to get around your IP restriction."

https://codereview.stackexchange.com/a/164608/93616

Am I practicing bad security? Should I explain in more vague terms like "Too many login attempts" or "You could not be logged in"?

**Update: ** In case there's any ambiguity, currently the too many attempts logic and message does not care if the attempts were successful or not.

On Code Review stack exchange, in response to code that informs the user when their login attempt failed because of too many login attempts from an IP, I was told

"Absolutely do not message end user telling them why login failed. You are giving a potential attacker critical information to aid them in attacking you application. Here you give an attacker very precise information to get around your IP restriction."

https://codereview.stackexchange.com/a/164608/93616

Am I practicing bad security? Should I explain in more vague terms like "Too many login attempts" or "You could not be logged in"?

On Code Review stack exchange, in response to code that informs the user when their login attempt failed because of too many login attempts from an IP, I was told

"Absolutely do not message end user telling them why login failed. You are giving a potential attacker critical information to aid them in attacking you application. Here you give an attacker very precise information to get around your IP restriction."

https://codereview.stackexchange.com/a/164608/93616

Am I practicing bad security? Should I explain in more vague terms like "Too many login attempts" or "You could not be logged in"?

**Update: ** In case there's any ambiguity, currently the too many attempts logic and message does not care if the attempts were successful or not.

1
source | link

Security implication of telling the user they can't login because of too many attempts from IP

On Code Review stack exchange, in response to code that informs the user when their login attempt failed because of too many login attempts from an IP, I was told

"Absolutely do not message end user telling them why login failed. You are giving a potential attacker critical information to aid them in attacking you application. Here you give an attacker very precise information to get around your IP restriction."

https://codereview.stackexchange.com/a/164608/93616

Am I practicing bad security? Should I explain in more vague terms like "Too many login attempts" or "You could not be logged in"?