Ask HN: Why can’t every webpage show the password requirements if entered wrong?

1 pointpunnerud3 comments

Security reasons, the more ambiguous you can keep it, the better it is for keeping bad actors away.

Same reason almost all sites don't tell you whether it's the email or password that was wrong when you create an invalid login attempt.

That would be helping the hackers, by saving them the 10 ~ 90 seconds at the start of their session it would take to determine the password requirements manually.

very often when you create a new account there are very often restrictions or arbitrary properties that reduce the number of brute force combinations required and provide a set of rules to generate a password

the user has to know what the password rules are, the hacker doesnt but when it does it has less work to do.

i dont know how we might separate the twain other than limiting creation and trial of passwords

Reply on news.ycombinator.com