Timeline for Is it a security vulnerability to tell a user what input characters are valid/invalid?
Current License: CC BY-SA 4.0
2 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 15, 2020 at 20:41 | comment | added | Cruncher | "A good system is secure even when an attacker knows everything about it." This conventional wisdom is of course, true. But when you gain no benefit of disclosing information to the user, don't. This is because complicated systems are essentially never 100% secure. In this specific case there's obviously a huge usability benefit, and definitely not a security issue, but you need to be careful when applying this logic to the general case | |
| Jan 14, 2020 at 21:57 | history | answered | dandavis | CC BY-SA 4.0 |