The website could know whether the username actually exists on the system. But revealing that information is a security weakness because someone could at least learn who has an account at that site (especially if usernames are email addresses, as they often are).
Right but not only is it a security weakness, but it’s also not helpful to the user. Point is the username probably exists in the system.
Say I went to a website to register TheFogan, but TheFogan already exists, so I created TheFogan2.
3 years later I go back to the website, try and log in with username: “TheFogan” password: “Hunter2”, and it tells me “your username is right but your password is wrong”. But in reality I have the right password for my account, but the site would just think I have the wrong password for the guy who beat me to my account.
So yeah agreed the primary reason for it is security, IE a fully user focused, while having bad security practices would be, a "if the username exists in the system, report “Username and password don’t match”, if the username doesn’t exist report “There is no user by this name in the system”. My point is the site only can know if they have a user by that username, not whether that is MY username.
The website could know whether the username actually exists on the system. But revealing that information is a security weakness because someone could at least learn who has an account at that site (especially if usernames are email addresses, as they often are).
Right but not only is it a security weakness, but it’s also not helpful to the user. Point is the username probably exists in the system.
Say I went to a website to register TheFogan, but TheFogan already exists, so I created TheFogan2.
3 years later I go back to the website, try and log in with username: “TheFogan” password: “Hunter2”, and it tells me “your username is right but your password is wrong”. But in reality I have the right password for my account, but the site would just think I have the wrong password for the guy who beat me to my account.
So yeah agreed the primary reason for it is security, IE a fully user focused, while having bad security practices would be, a "if the username exists in the system, report “Username and password don’t match”, if the username doesn’t exist report “There is no user by this name in the system”. My point is the site only can know if they have a user by that username, not whether that is MY username.