Hacker News Reader

Comment by sgjohnson | Hacker News Reader

I'd say it's wrong to assume it's even a security measure. I'm fairly sure it goes like this

if (db->query("SELECT * FROM `users` WHERE `email` = 'yesthisisdog@gmail.com' AND `password` = MD5('hunter2')") {

    login(username);

} else {

    error('invalid username or password');

}

with nobody giving it a second thought.

View on HN

As someone who written countless of this authentication mechanisms or led teams that have, there has been 0 times the vague message have been by accident like you described and 100% on purpose to prevent information leakage. But that's just one (20+) anecdote(s).

Which in itself would be a bad security practice because that would mean that the passwords aren't individually salted.

And they would be hashed using MD5!

But on a serious note, it's possible to individually salt passwords, and still match username & password in one query.