this post was submitted on 10 Apr 2026

158 points (91.1% liked)

Programmer Humor

33499 readers

111 users here now

Welcome to Programmer Humor!

This is a place where you can post jokes, memes, humor, etc. related to programming!

For sharing awful code theres also Programming Horror.

Rules

Keep content in english
No advertisements
Posts must be related to programming or programmer topics
- If the mod doesn't find it funny, you're banned. Ha-ha!... For real: do not use the community for "statements". There are other places for such content. Keep it chill and funny.

founded 3 years ago

MODERATORS

Feyter@programming.dev

anzo@programming.dev

BurningTurtle@programming.dev

pylapp@programming.dev

158

The mist of the www (feddit.org)

submitted 5 months ago by NichEherVielleicht@feddit.org to c/programmer_humor@programming.dev

89 comments fedilink hide all child comments

top 50 comments

sorted by: hot top controversial new old

[–] rizzothesmall@sh.itjust.works 61 points 5 months ago (2 children)

Being able to determine if a username is valid without a valid password is a security flaw

[–] cactusupyourbutt@lemmy.world 8 points 5 months ago (6 children)

I keep hearing that, yet the websites will gladly tell you that the username is taken when trying to register

[–] meekah@discuss.tchncs.de 5 points 5 months ago

I'd assume the spam protection for signing up is a lot tighter than the one for logging in

load more comments (5 replies)

[–] theo@lemmy.world 7 points 5 months ago (1 children)

I was having a chat about this with a UX guy. His argument for using a similar flow was that the username/email will have to be validated at the point of registration anyway so you might as well make it easier for the user when the email is wrong. I couldn't really refute this logic.

If you throttle both login and registration, then surely the risk is minimised while keeping the user happy?

[–] LeapSecond@lemmy.zip 14 points 5 months ago (4 children)

You see the registration problem in so many places. If the username is an email, the proper way to validate it without revealing if an account exists is to accept any email address and if it already exists say that in the registration email you would send anyway. With the appropriate throttling if needed.

load more comments (4 replies)

[–] eager_eagle@lemmy.world 43 points 5 months ago (1 children)

[–] AlbertUnruh@feddit.org 29 points 5 months ago (2 children)

[–] eager_eagle@lemmy.world 15 points 5 months ago* (last edited 5 months ago)

whew

thankfully they redacted the phone nunber

load more comments (1 replies)

[–] M137@lemmy.world 20 points 5 months ago (1 children)

It's hilarious how all OP did with this post is show everyone how dumb they are.
Seriously, how do you NOT understand the security risk of that?

[–] lobut@lemmy.ca 9 points 5 months ago (2 children)

I remember there was a joke about this back in the day were someone put a joke error message saying: "that password belongs to ninja123, please enter your password"

load more comments (2 replies)

[–] the_riviera_kid@lemmy.world 19 points 5 months ago (1 children)

It's called security.

[–] kryptonianCodeMonkey@lemmy.world 18 points 5 months ago (16 children)

"Wrong username. Correct password."

"Uh.... who's password?"

[–] bleistift2@sopuli.xyz 13 points 5 months ago* (last edited 5 months ago) (1 children)

I don’t know who is password, or why is password, or when is password, but I do know where is password, and it’s out there!

[–] Buddahriffic@lemmy.world 4 points 5 months ago

But... how is password? Secure enough?

[–] Buddahriffic@lemmy.world 5 points 5 months ago

Error: password already in use by CobainKiller94

load more comments (14 replies)

[–] roofuskit@lemmy.world 17 points 5 months ago

Just good security, nothing to see here.

[–] waigl@lemmy.world 16 points 5 months ago (3 children)

Any further "helpful" information in that error message would be a security issue.

[–] gibson@sopuli.xyz 2 points 5 months ago

While true most of these websites expose valid usernames in other places

[–] Xavienth@lemmygrad.ml 2 points 5 months ago

Couldn't you just try and register the username to see if it's valid?

[–] mech@feddit.org 12 points 5 months ago* (last edited 5 months ago) (3 children)

Yeah, the error message could be more helpful:

Wrong password. Try again.
Hint: the correct password is gHI6shTI2!

[–] Pika@sh.itjust.works 6 points 5 months ago

Not gonna lie back when websites had password hints that you could do. I used to put something like that where it wouldn't be the full password, but it would be either a part of the password or I would label it as same as computer password or something like that.

God, I was so insecure when I was young.

[–] kubica@fedia.io 3 points 5 months ago (1 children)

2nd hint: Maybe your have a second account with any of this names: ...

[–] onlinepersona@programming.dev 3 points 5 months ago (2 children)

3rd hint: their passwords are...

load more comments (2 replies)

[–] joyjoy@lemmy.zip 2 points 5 months ago

AI slop is great, isn't it?

[–] saltesc@lemmy.world 7 points 5 months ago* (last edited 5 months ago) (2 children)

try all passowrds. Fail

Maybe I don't have an account...

create new account. email already in use. Fail.

Okay, guess I'll reset the password through email.

password can't be one already used. Fail

WHAT?!

[–] wheezy@lemmy.ml 2 points 5 months ago

I too only type my password correctly when I go to reset it.

load more comments (1 replies)

[–] RamenJunkie@midwest.social 6 points 5 months ago

My bigger beef is when I enter the wrong email and it rolls me over to a sign up screen.

Fucker, I have an account, I just don't remeber which of my 20 email addresses it is.

[–] RogueBanana@piefed.zip 6 points 5 months ago

Cisco VDI took their security to another level. Wrong password? system down? account locked? Always "Please try again later or contact support".

[–] zxqwas@lemmy.world 5 points 5 months ago

If they told you the user name is wrong you may as well publish a list of usernames of your site.

[–] MimicJar@lemmy.world 3 points 5 months ago

Website: Wrong user name or password.

Me: Password.

Website: Correct! Come right in.

[–] chattre@lemmy.blahaj.zone 3 points 5 months ago (2 children)

"Something went wrong."

motherfucker I will OPEN UP THE NETWORK INSPECT TAB AND FIGURE OUT WHAT WENT WRONG.

[–] LeapSecond@lemmy.zip 7 points 5 months ago (1 children)

Network tab: server returned an html page with the words "Something went wrong."

[–] Jakylla@jlai.lu 4 points 5 months ago (1 children)

Classical error code 200

[–] 123@programming.dev 3 points 5 months ago (1 children)

Had manager that wanted us to return error codes on a field of an API response along with an HTTP 200 because "errors bad". It needed a few of us to make him understand how that worked against common design patterns and you still had to handle error codes since you didn't know if the error would be coming from the app, web server, api gateway, local network (no internet), etc.

load more comments (1 replies)

[–] mitsosimo@programming.dev 2 points 5 months ago

The absence of details makes the website more secure.

[–] TheFogan@programming.dev 2 points 5 months ago (6 children)

yeah real question how would the website even know. Whole point is to match the 2 things together. Is hunter2 my password, well that depends who are you, we've got plenty of users that have that hunter2 password

[–] TheYojimbo@lemmy.world 2 points 5 months ago (2 children)

Not exactly. It should check for the username and password separately. First check if the user exists, then check if the salted passwords match.

load more comments (2 replies)

load more comments (5 replies)

load more comments