Error messages

[hugme]

I have a software package I am trying to set up at work... here is a quote I found on a mailing list from they guy who wrote it:

"...is deliberately obtuse error so that potential hackers will not know why the failure occurred"

because obscurity is security!! right? right?

...sigh...

Comments

[techno--mage.livejournal.com]

it would be better not to show an error at all, ...just as useful

[techaholic.livejournal.com]

I believe the nature of the statement is akin to saying "login failure" as opposed to "bad password" or "bad username"

the level of vagueness of the failure message is to help slow down the unraveling of the login puzzle.

It's a small but useful thing.
I've seen your login failure messages. you already practice this security through obscurity method. there is nothing inherently wrong with it as long as it is not meant as a substitute for better security.


$0.02


Robert

[karazorel.livejournal.com]

I love the message "An error has occur" [OK] ;)

It secures my total distate of the program ;)