In cass it’s not clear from other comments, if the site tells you either one’s wrong but not both, you can then brute force and try out a bunch of usernames and passwords to effectively farm for both: those that say “wrong username” means that the password is valid, while those that say “wrong password” means you got the username that’s in the system.
Once you’ve collected them, the rest is just trying out every password for every user.
So… while this seems weird for a person, it is very much intentional.
Edit after several comments: I don’t know why it’s hard for people to look at the OP, take it for what it is, and argue for the sake of the argument, rather than claiming that something’s impossible because of common or correct technical practices.







I live in Ontario, and I feel like I’m living in a bubble, because not a single person I’ve talked to likes Drug Fraud, but Ontario voted this sack of shit thrice into the office. Everything feels like it’s in fucking shambles: the housing, healthcare, education (all the levels!); anything public aside from fucking businesses.
But then again, there’s also an insane amount of political apathy amongst my peers (I’m around 30). No one believes that their ability to vote means anything. I’m not allowed to vote (I’m a PR), and I have to find ways to tell my friends to go fucking vote. While it’s true that if shit hits the fucking roof I can always just move out, it hurts me to just watch my friends suffer, especially when a number of them are teachers and nurses, and they recount the sad episodes of the kids in schools and the patients in hospitals not getting the care they need.