one aspect in security, which has been wrong even in some of the linux foundations pages from time to time is that they differentiate answers between "incorrect password" and "acount does not exist". this should be obviously opaque.
it allows to query which sites user has an account, which is useful information in wrong hands already.
#infosec #oracle
Jarkko Sakkinen
npub1np…8jmll
2025-11-26 03:07:12 UTC
Author Public Key
npub1npg6ts4xz56xszqzuhkcdk6td72059mv7yu4pgskwaszzataxrdsa8jmllSeen on
wss://relay.ditto.pubPublished at
2025-11-26 03:07:12 UTCEvent JSON
{
"id": "fc8d40d23f33bb1c2aa017f939a8dc1a02ab5f2d3b921bcf5f0c3606f77a21d2",
"pubkey": "9851a5c2a61534680802e5ed86db4b6f94fa176cf13950a216776021757d30db",
"created_at": 1764126432,
"kind": 1,
"tags": [
[
"t",
"infosec"
],
[
"t",
"oracle"
],
[
"proxy",
"https://social.kernel.org/objects/4cc8d023-e098-4756-b94e-41f4f9890c51",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub/"
]
],
"content": "one aspect in security, which has been wrong even in some of the linux foundations pages from time to time is that they differentiate answers between \"incorrect password\" and \"acount does not exist\". this should be obviously opaque.\n\nit allows to query which sites user has an account, which is useful information in wrong hands already.\n\n#infosec #oracle",
"sig": "1abb0f1132b8b0b83f1bbb7f36dbbd0eaff34c18f93d278f6538874af53063b449e1b6215ad16d3f245f70760ea8cbba3cc5cbdaea40871d6c6343df1e789ae7"
}