Ok, great, working from your example and my example combined, in order to continue the illustration:
I'm still the same hacker. I've got the list of valid usernames, and I'm trying to figure out where to put my effort for cracking passwords in.
When I hammered the login endpoint I noticed something interesting:
- most responses were 404 Not Found (no user by that name)
- some responses were 403 Unauthorized (invalid login)
- But the payload of the responses varied across the 403 responses:
- most had
{"error": "invalid password"} - but a few had
{"error": "password expired"}
- most had
- But the payload of the responses varied across the 403 responses:
This is fantastic! The server's login endpoint gave me all the information I needed to filter this huge list of real usernames into something more reasonable to work with! Additionally, if a user's password is expired, there's a higher likelihood its an abandoned account (won't notice when I log in as them), or someone who doesn't take security all that seriously (ideal social engineering victim), so essentially I have a list of this service's most vulnerable users.
So let's say I take this list and focus all my energy on breaking in as them. Lots of options for that:
- I could try brute-forcing their password
- pros:
- will eventually work (unless the user changes their password to something I've already tried during my attempt)
- cons:
- loud, noticeable
- takes forever
- costly
- pros:
- I could try finding them (lots of people use the same username across services, so I find them on Lemmy, learn their dog's name, country, married status, industry, perhaps even real name, by digging hard enough, then I target my password attempts to probable combinations)
- pros:
- learn about people
- make a few friends along the way
- higher likelihood of success
- cons:
- learn about people
- make a few friends along the way
- pros:
- I could try searching for this username in leaked database tables
... Actually, look, I hope you get it at this point, I don't have to write a book. You don't need an exhaustive list of all the ways people find and crack passwords. You just needed to know how responding with "expired" vs a binary "invalid"/"valid" response weakens security, and if I haven't demonstrated that to you at this point, I'm wasting both of our time.
Responding with additional information makes hackers' jobs easier.
That's what we're all trying to say.