I am curious as to what happens when this is done with an existent user? I feel like there would be different behaviors for timeouts when a non-existent username is used and when a wrong password is used for an existent username.
I should have elaborated better. I think that the feedback should in theory always be the same. However, the check for existent user and the check for correct password are different procedures in the program. The program masks this fact by always having one feedback prompt for actions that don't result in login. Perhaps the original bug report only allowed multiple retries for existent users but not for non-existent users, thus shattering the illusion that the feedback is always the same.
Comments
I am curious as to what happens when this is done with an existent user? I feel like there would be different behaviors for timeouts when a non-existent username is used and when a wrong password is used for an existent username.
No, the behavior needs to be identical in all failure cases or attackers can use the different feedback to learn valid usernames, etc
I should have elaborated better. I think that the feedback should in theory always be the same. However, the check for existent user and the check for correct password are different procedures in the program. The program masks this fact by always having one feedback prompt for actions that don't result in login. Perhaps the original bug report only allowed multiple retries for existent users but not for non-existent users, thus shattering the illusion that the feedback is always the same.