Keep error messages vague

- Hackers use the results of their actions … to improve their chances of success. … Imagine that a hacker visits a standard login page … on a website, and they try a user name and password. … If the response is user name not found, … then the hacker knows to try a different user name. … If after a few tries the response changes … to password not found, … they'll know they've made some progress. … And they've found a valid user name. … A more secure approach is to return an identical … login failed message in both cases. … Don't tell a hacker when their actions … are getting warmer or colder. … They can just use that information to adjust their attacks. … Give as little information back as necessary. … This applies to all user messages … but especially to error messages. … These may be errors that you're expecting … and handling like failed logins. … Or they may be unexpected errors … caused by bugs in your code. … When developing a website, … it's helpful to have error reporting enabled …