The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

process using an invalid username, the application may behave differently:

because there is no user profile associated with an invalid username, there 

will be no stored question, and so a varying question will be presented. The

attacker can use this difference in behavior, manifested across several login

attempts, to infer the validity of a given username. In a scripted attack, he will

be able to harvest numerous usernames quickly.

If an application wishes to defend itself against this possibility, it must go to