No! I cannot! I will not! You can't make me!!!!1!

[spudtater]

Excerpt from the assignment given as part of the "server-side programming" module:

If the username and password are not correct, open a window, displaying “The login failed!”. Also display whether username or password is incorrect.

To all non-programmers on my friends list: can you figure out why this would be a bad and wrong thing to do?   8^]

Comments

[mr-purpleduck.livejournal.com]

... Also be careful of giving these those details away with the amount of time it takes to respond if the username or password is incorrect.

[spudtater.livejournal.com]

This is over t'internet, so I imagine this information will be lost in the noise anyway...

[mr-purpleduck.livejournal.com]

That really depends, the following issue in OpenSSH with PAM enabled, did just that. A valid user account would take longer to be rejected than a invalid one.

http://lab.mediaservice.net/advisory/2003-01-openssh.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0190