"An application should respond with a generic error message regardless of whether the user ID or password was incorrect."
I really don't like this advice (although I see why they put it in there).
I often use different email addresses for different services so that I can determine who sells on email addresses (depending on how much I trust them), and quite often I can't remember which email address I signed up with (was that [email protected] or [email protected]).
At least if I see "user not recognised", I know to try a different email address.
I really don't like this advice (although I see why they put it in there).
I often use different email addresses for different services so that I can determine who sells on email addresses (depending on how much I trust them), and quite often I can't remember which email address I signed up with (was that [email protected] or [email protected]).
At least if I see "user not recognised", I know to try a different email address.