Changing generic brute force error message on login page.

[Former Member]

Hi,

OOTB hybris blocks a user account after 5 unsuccessful login attempts, but after the account is locked it still shows "Your username or password was incorrect." generic error message. If we change this error message to be more informative like "Your account is locked.", will it be a security concern as the brute force attacker can find out the valid usernames from the site and then misuse them for further security attacks.

I am referring the below statement from the link https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks (point 2 under section locking accounts) .

•Because you cannot lock out an account that does not exist, only valid account names will lock. An attacker could use this fact to harvest usernames from the site, depending on the error responses.

I am using Hybris 6.6 .

[Former Member]

Is the customization encouraged ? or is there a trade off between security and better user experience?

[VinayKumarS]

Yes as you described. If you say the error message saying that your account is locked. Then others know the account exists and password is wrong. But these messages can be customized as we want. OOB doest show the message as locked.