My guess is that the error message is broken -- the programmer probably meant to say that the password must match the username.

Posted by: Heng-Cheong at March 23, 2004 03:29 AM

Good point - that's probably it.

Posted by: Mark Hurst at March 23, 2004 07:41 AM

As soon as I saw "healthcare website" next to that I thought: "HIPAA? Yeah we've heard of it!"

True, it's probably supposed to mean "your password doesn't seem to go with your username," but intead of putting the top message on, and then -another- one underneath with a little asterisk, why not just say:

"Login Incorrect

Please check your username and password [and try again]"

No need to make the end-user error message sound fancier than that.

And you don't want to have seperate error messages for "Username invalid" as well as "password incorrect" - that would allow a would-be attacker to figure out what usernames were valid first, and then force passwords against known usernames.

Posted by: Jameel Akari at March 30, 2004 10:42 PM

That's United Health Care for you!

Posted by: Shaine at March 31, 2004 12:23 AM

Maybe it's supposed to say "Password must NOT me same as username." Is your username and password identical?

Posted by: SrbComp at June 14, 2004 10:37 AM