A hacker wants to discover login names that may exist on a website. Which of the following responses to the login and password entries would aid in…

User enumeration is a vulnerability where an attacker can determine if a username is valid based on the application's response to login attempts. This is possible when the system provides different feedback for an invalid username versus an invalid password.

A response like "Invalid password" (B) implicitly confirms that the username provided was correct. Similarly, a response like "That user does not exist" (C) explicitly confirms the username is invalid. By observing these distinct responses, an attacker can systematically test a list of potential usernames to identify valid accounts on the system. Secure applications should provide a single, generic error message for all failed login attempts.

A. This is a generic message that does not differentiate between a bad username or password, which is a security best practice to prevent user enumeration.

D. This is a properly implemented generic error message that intentionally obscures whether the username or the password was the incorrect component of the login attempt.

E. Similar to options A and D, this is a generic response that prevents an attacker from inferring if the username was correct.

1. University of California

Berkeley. (2020). CS 161: Computer Security

Lecture 12: Web Security. Slide 37

"Authentication Design Flaws". The lecture slide explicitly warns against this vulnerability: "Don’t return different error messages for 'user doesn’t exist' vs. 'wrong password'

" which directly corresponds to options C and B

respectively.

2. Stanford University. (2021). CS 155: Computer and Network Security

Lecture 10: Web Security (Auth). Slide 21

"User enumeration". This slide details how attackers can "learn valid usernames" if the server provides different error messages for a "bad username" versus a "bad password

" confirming that such specific responses aid in discovery.