Most of the times my password is same as/a variant of a generic password that I keep on most of the sites. Now usually what happens is that some website has some specific rule for setting passwords like it should be alphanumeric, have one Special character, or a capitalized character etc. Due to this, I end up resetting my password which wouldn't be needed if I was aware of the password rules. Wouldn't it be simply better if websites can simply tell you the password rules in case of failed password attempt. I don't see any security issue with that. Do other HNers face similar problem?
There is no security issue with that. This "feature" would definitely be useful (and in a way needed), even though I use a password manager anyways.
1. Don't use the same password everywhere.<p>2. Use a password manager like LastPass or 1Password.<p>Regardless of the incidental security risk of showing those rules, the site shouldn't facilitate your irresponsibility when it comes to password management.
On a similar note, why do we have to use the error message "Wrong username or password"? Can't any hacker just try to make an account with a username to see if it exists?
I agree. There shouldn't be any security issue with that (unless your password rule is, "no more than 4 digits", even then).<p>This is one of those things that I think should culturally change. Maybe it can start with YC companies?