0

In the login page of my software, there are 3 input fields - organization, username, and password. There isn't an option to register, but the registration is done by the organization manager. Currently, the error message when the credentials are wrong is "The username or password is not correct". My question is - the message also appears when the organization doesn't exist and it is confusing (security wise, I can't present which of the fields is wrong), what would be the ideal message in this case?

3

Usually login error messages avoid specifying whether it was the username or password that was the problem. This is because they don't want to give away information to third parties on the correct usernames that are in the system. The more information that a third party can get, the more likely it is that they can find a way to compromise your system.

Do you want third parties to be able to guess the names of the organisations that are using your system? Could this information be used to create phishing emails?

I would go for something really generic like "Login details are incorrect".

  • Or even, "Login details (possibly including organisation) are incorrect" if OP wanted to make it more explicit that an incorrect organisation name could be the problem. – TripeHound Nov 5 '18 at 16:20
  • @TripeHound Yeh, that could work. It points them to the field without giving away anything. – Franchesca Nov 5 '18 at 16:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.