2026-04-10 13:58 UTC
yeah real question how would the website even know. Whole point is to match the 2 things together. Is hunter2 my password, well that depends who are you, we've got plenty of users that have that hunter2 password
Replies (4)
-
@GamingChairModel@lemmy.world 2026-04-10 15:35
The website could know whether the username actually exists on the system. But revealing that information is a security weakness because someone could at least learn who has an account at that site (especially if usernames are email addresses, as they often are).
-
@TheYojimbo@lemmy.world 2026-04-10 15:13
Not exactly. It should check for the username and password separately. First check if the user exists, then check if the salted passwords match.
-
@PattyMcB@lemmy.world 2026-04-11 21:02
Not unless they store the passwords in plaintext or their hashing implemention is garbage
-
@Malgas@beehaw.org 2026-04-11 08:33
> we’ve got plenty of users that have that hunter2 password Speaking of things the website shouldn't even know...