<p>medium bookmark / Raindrop.io | There’s a security best practice where sign ins aren’t supposed to say “password is incorrect”. Instead they’re supposed to say the “username or password is incorrect”. This “best practice” is bullshit. Stripe and GitHub’s sign ins for example follow this practice. The idea is if an attacker knows a username, [&hellip;]</p>