blocks|key|1355040|text|这样做的目的是不给黑客额外的信息。如果你说错误的密码，你已经告诉黑客他们有一个正确的用户名，反之亦然。虽然你说的是真的，但在一些网站上，你可以通过其他方式来判断你是否猜到了一个用户名。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1355041|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

The idea is to not give hackers extra information. If you say wrong password, you've told a hacker that they have a correct username, and vice-versa. Although what you've said is true, on some sites it is possible to determine if you've guessed a username via other means.

blocks|key|1355053|text|在某些情况下，您不希望攻击者能够猜测帐户的存在。因此，您将始终返回泛型错误消息，以便攻击者无法猜测该帐户是否存在。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1355054|在GMAIL上下文中，很可能gmail不希望人们挖掘垃圾邮件机器人使用的现有电子邮件地址。|1355055|您可以决定在应用程序中是否需要强制执行安全性，或者您是否可以提供更多用户友好的错误消息。|1355056|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

In some contexts you don't want an attacker to be able to guess the existence of an account. So you'll always return the generic error message so that an attacker cannot guess if this account exists or not. 

In GMAIL context's, it's probably that gmail doesn't want people mining the existing email addresses to be used by spam robots. 

Yourself can decide whether enforcing security is a need in your application, or if you can provide more user-friendly error messages.

blocks|key|1355096|text|最容易和最常见的短语是：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1355097|“您输入了无效的用户名或密码”|1355098|这背后的理由是防止有人试图通过“猜测”密码来强迫你的帐户。如果攻击者获得详细说明密码不正确的错误，则他们可以尝试不同的密码，直到正确为止。|1355099|但是，如果您提供了像上面这样的通用消息，攻击者就不知道用户、密码或两者的组合是否正确。|1355100|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|L|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|M|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

The easiest and most common phrase to use is:
&quot;You have entered an invalid username or password&quot;
The reasoning behind this is to prevent someone from trying to brute force your account by 'guessing' the password. If the attacker gets an error detailing the password is incorrect, then they could try different passwords until getting it right.
However, if you provide a generic message like the one above, the attacker doesn't know if the user, password or combination of both is correct or not.

blocks|key|1355160|text|只是加了些额外的信息。OWASP指导方针为您提供有关此问题的建议。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1355161|Sheet.html#authentication-and-error-messages|offset|length|1355162|无论用户ID或密码是否不正确，应用程序都应使用通用错误消息进行响应。它也不应说明现有帐户的状况。|blockquote|1355163|1355164|entityMap|0|LINK|mutability|MUTABLE|url|https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages^0|0|0|18|0|0|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@]|9|@$D|T|E|U|1|V]]|A|$]]|$1|F|3|G|5|H|7|W|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|X|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|Q]]]]

Just adding some extra information. OWASP guidelines give you recommendations about this issue
<a href="https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages" rel="nofollow noreferrer">https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages</a>
<blockquote>
An application should respond with a generic error message regardless
of whether the user ID or password was incorrect. It should also give
no indication to the status of an existing account.
</blockquote>

blocks|key|1140089|text|从不同的角度来看，从安全性的角度来看，这两种信息并没有太大的不同。至少对于允许注册的网站。黑客可以随时访问注册页面并尝试使用上述详细信息进行注册。当然，你的网站，最初是由模糊的保护，将立即大喊“用户名被拿走！”或者“那封邮件已经注册了！”在这一点上，安全是个神话。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1140090|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Well, from a different point of view, security-wise, the two messages aren't much different. At least for sites that allow registration. The hacker could always go to the registration page and try to register with the said details. Of course, your website, which was initially secured by ambiguity, will straight away shout &quot;that username is taken!&quot; or &quot;that email is already registered!&quot; and it'd look like at that point security is a myth.

Is there any differences between the following two error messages from security point of view when users entered a wrong password?
<blockquote>
Wrong username or password.
Wrong password.
</blockquote>
For example, when you enter a wrong password on the <code>Gmail.com</code>, it will tell you &quot;The username or password you entered is incorrect&quot;.
Is there any considerations for security reasons? I think the error message: &quot;The password you entered is incorrect&quot; is more clear to users, And, What's more, it's very easy to check whether a username is exists on the <code>Gmail.com</code>: just click &quot;Can't access your account?&quot; and enter the username. If the username doesn't exists, it will tell you.

Which error message is better when users entered a wrong password?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

从安全角度看，当用户输入错误密码时，以下两条错误消息之间有什么区别吗？用户名或密码错误。密码错了。例如，当您在Gmail.com上输入错误的密码时，它会告诉您“您输入的用户名或密码不正确”。是否出于安全考虑？我认为错误信息：“您输入的密码不正确”对用户来说更清楚，而且，更容易检查Gmail.com上是否存在用户名:只需...

问当用户输入错误密码时，哪一条错误信息更好？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问当用户输入错误密码时，哪一条错误信息更好？EN