Comment 5 for bug 579942

Revision history for this message
Kees Cook (kees) wrote :

The correct way to handle this is to have a single error message instead of two, so that bad password is indistinguishable from bad username.