No! I cannot! I will not! You can't make me!!!!1!

[spudtater]

Excerpt from the assignment given as part of the "server-side programming" module:

If the username and password are not correct, open a window, displaying “The login failed!”. Also display whether username or password is incorrect.

To all non-programmers on my friends list: can you figure out why this would be a bad and wrong thing to do?   8^]

Comments

[xenophanean.livejournal.com]

Tells the security hacker if he's got one thing right. Particularly bad if he's found a good password, as then he only needs to know all the usernames to gain access. As many passwords are kinda common, names, satan666 etc, not hard to do.

(not a programmer)

[spudtater.livejournal.com]

Bingo. Try a whole load of potential passwords, and end up with N valid ones. Then try a whole load of usernames, and end up with M valid ones. Then you only have to try NxM combinations of the two lists, with a fairly good probability of hitting a good combination.

Btw, somebody investigating myspace passwords found that the most common password was... wait for it... "password".   8^)