In the login page of my software, there are 3 input fields - organization, username, and password. There isn't an option to register, but the registration is done by the organization manager. Currently, the error message when the credentials are wrong is "The username or password is not correct". My question is - the message also appears when the organization doesn't exist and it is confusing (security wise, I can't present which of the fields is wrong), what would be the ideal message in this case?
1 Answer
Usually login error messages avoid specifying whether it was the username or password that was the problem. This is because they don't want to give away information to third parties on the correct usernames that are in the system. The more information that a third party can get, the more likely it is that they can find a way to compromise your system.
Do you want third parties to be able to guess the names of the organisations that are using your system? Could this information be used to create phishing emails?
I would go for something really generic like "Login details are incorrect".
answered Nov 5, 2018 at 14:02
-
Or even, "Login details (possibly including organisation) are incorrect" if OP wanted to make it more explicit that an incorrect organisation name could be the problem. Nov 5, 2018 at 16:20
-
@TripeHound Yeh, that could work. It points them to the field without giving away anything. Nov 5, 2018 at 16:40