There's an old joke that, unfortunately, all too often turns out to be a harsh reality.
Imagine this: you register on a website, create a complex password, and the system responds: "Error: this password is already in use by user admin." Or you try to log in to your email, enter your username, and see: "No user with this email found."
From a UX perspective, this is convenient. From a security perspective, it's a disaster.
At RK-CMS, we adhere to the principle: the user shouldn't know why the system crashed.
A hacker rarely hacks a website directly, sitting at a console with a black screen. More often, an attack is a methodical collection of information.
The mechanics are simple:
- On the password recovery page, you enter [email protected]. The system responds: "The password has been sent to your email." Okay, the user exists.
- You enter [email protected]. The system responds: "The user with this email is not registered."
That's it. You've just given the hacker your list of logins for free. All that's left is to brute-force the password or find a password leak for this user in another database.
RK-CMS's approach: Our forms always use a "secure response."
At RK-CMS, we operate under the Zero Trust paradigm. We don't trust anyone outside the admin panel. And we're very wary of anyone in the admin panel, either.
When our client asks, "Make it so that when a login error occurs, it says the password is incorrect, not the login," we refuse, explaining the risks.
