Today like many other times in the past, signed for a new service and got a common error message:
Your user name or password is invalid
This time I am wondering how useful it is to notify "invalid password OR user" versus a less common but more useful two message schema with the real problem: "unknown user", "invalid password"
My thought was that a system that does not specify if the user name is valid, could be more secure because it will not expose valid user names. However, how practical is this in real life? Although enabling the possibility of mining a list of user names. How much of a threat can that be? Is it really worth degrading a little bit the login user experience (ambiguous error) in exchange of hiding the list of users?
Right now the idea of exposing the list of valid user names seems like a very bad thing. However I am not really sure if it is just unjustified security paranoia that is not really practical. Even if an attacker might get a list of good user names that he could try to brute-force attack, but if the user names are made public (like in a forum), is it just paranoia avoiding to expose valid user names?
In a forum for example, a web crawler would be far more efficient collecting user names than a user name generator brute force logger. I was wondering if there are valid cases where ambiguous logging errors are practical at all.