CyberCertPrepWeb App FundamentalsAuthentication BasicsEASYFree question
An application displays the error message 'This email is not registered with us' on the login page. Why should this be changed?
- A.It is too long and slows the page load
- B.It violates cookie consent regulations
- C.It enables user enumeration: an attacker can confirm which email addresses are valid accounts by systematically testing addresses. The message should be identical for wrong email and wrong password: 'Incorrect credentials'
- D.It might confuse users and reduce conversion rates
Why C is correct
Distinct error messages for 'email not found' vs. 'wrong password' allow attackers to enumerate valid accounts. With a confirmed email list, they can mount targeted credential stuffing, spear phishing, or password spraying attacks. Generic 'Incorrect credentials' responses deny this information without harming legitimate user experience significantly.
Know someone studying for Web App Fundamentals? Send them this one.