Is there a security reason for not identifying a user ID?

Question

I noticed that on some sites, when you ask for a reminder or login, they tell you if there is a user (I think Meetup does this). Other sites will simply say, "the user / password combination is incorrect" (Google, I believe, does this).

Is there a security reason for not identifying a user ID?

Answer 1

Yes there is.

Do you want to give attackers as little information as possible

, . , , [e-mail], gmail. , , (, db), , [e-mail] .

, , : Username.Length + Password.Length long, , .

Answer 2

: , .

: , , () .

Answer 3

, , . : , , ; , , - . , ( " " ) .

Answer 4

, . - .

: , . , , . - , .

()

, , . . (, , , , .)

, , , . , , ! , , , .

()

, , . , , , , , . : , - . , , , , -, , . .

- ( , ), "": -, , . , "" , . , . : " , PIN-, " " , , PIN- ".

, . ? . " " - , ( ). , ( ).

Answer 5

, . , , - , , .

Answer 6

As a rule, do not give the attacker more information that is absolutely necessary. Someone enters an email address that is not included in your system, you do not need to tell them whether this letter exists or not, therefore not.

There are certainly stronger forms of defense, but for “defense in depth” every little thing adds up.