Make incorrect username/email and incorrect password return same error message

[SleeplessOne1917]

Requirements

• Is this a feature request? For questions or discussions use https://lemmy.ml/c/lemmy_support
• Did you check to see if this issue already exists?
• Is this only a feature request? Do not put multiple feature requests in one issue.
• Is this a backend issue? Use the lemmy-ui repo for UI / frontend issues.

Is your proposal related to a problem?

In a recently opened PR for the UI repo, I noticed that the server returns distinct error messages for incorrect usernames/emails and incorrect passwords. This will make it easier for an attacker to figure out if a brute force attack is successful.

Describe the solution you'd like.

Use the same error message for both. Something like "incorrect_username_email_or_password".

Describe alternatives you've considered.

Leaving it the way it is.

Additional context

No response

[rosenjcb]

This would be very easy to swap out. Simply update lemmy-translations with a new key (e.g. incorrect_login) and the code can be swamped out simply:

lemmy/crates/api/src/local_user/login.rs

    // Verify the password
    let valid: bool = verify(
      &data.password,
      &local_user_view.local_user.password_encrypted,
    )
    .unwrap_or(false);
    if !valid {
      return Err(LemmyError::from_message("incorrect_login"));
    }
    check_user_valid(
      local_user_view.person.banned,
      local_user_view.person.ban_expires,
      local_user_view.person.deleted,
    )?;

    // Check if the user's email is verified if email verification is turned on
    // However, skip checking verification if the user is an admin
    if !local_user_view.person.admin
      && site_view.local_site.require_email_verification
      && !local_user_view.local_user.email_verified
    {
      return Err(LemmyError::from_message("incorrect_login"));
    }

[rosenjcb]

Here's my PR for the lemmy-translations update btw: LemmyNet/lemmy-translations#83

[Nutomic]

This seems to be fixed, there is only IncorrectLogin error.