Why login never says 'no account with that email'

transcript

Type an email that doesn't exist. Invalid credentials. A real email, wrong password? Invalid credentials. On purpose.

An unknown email gets one message. A real email with the wrong password gets the exact same one.

If the messages differed, an attacker could probe emails. Learn which ones have accounts. Then focus the guessing there. So the reply never confirms that an account exists.

Login starts with a limit. 5 failures locks it for 15 minutes. Then the password, checked against its bcrypt hash. Only after the password is proven does it check if the account is active. MFA guesses are rate limited too. A 6 digit code is brute-forceable without that.

But defenders still get the truth. The audit log says user not found, or invalid password. With the IP address. And the lockout after 5 failures.

Only the client-facing message is identical. Tell attackers nothing. Tell your audit log everything.

Full breakdown in the lecture.