Group two of six
Getting in
A login screen that says no gives you almost nothing. The same blank form comes back whether the answer was wrong, whether nobody looked at it, or whether the account is not yours any more.
Why refusals are so hard to read
A login form that explained its refusals would be handing information to whoever is guessing at accounts. So it does not explain them. It shows one message for every case, and the message is deliberately uninformative.
This is good design and it is also why this group exists. The reader has to work out from context what kind of no they just got, and the wrong reading turns a two minute wait into an hour of increasingly frantic retries.
Every pair here separates by asking where the decision was made rather than what the screen said. A counter refusing you and a comparison refusing you produce identical output and behave completely differently over the next ten minutes.
Rate limiting against a password that no longer matches
Getting in / Pair 08Rate limiting against A wrong password
A counter that refused you without reading, or a comparison that read you and said no.
The test: Stop attempting, wait out the window, then spend one attempt you are sure of
When the puzzle is broken and when the reader is
Getting in / Pair 09A captcha that will not pass against A captcha you are typing wrong
The puzzle is failing, or your reading of it is. One of those has you looking for a new door.
The test: Reload the challenge without typing and see whether it comes back new and legible
A door you shut yourself against a lock somebody changed
Getting in / Pair 10An account you are locked out of against An account that was taken
A door you shut on yourself and a door somebody else changed the lock on look the same from outside.
The test: Retrace where you last entered the credential and whether that address came from you
Logged out by a clock against logged out by a decision
Getting in / Pair 11A session that expired against A session that was ended for you
Being logged out by a clock and being logged out by a decision produce the same empty page.
The test: Log in once more and read the first screen after it, not the one that threw you out
A code that does not match against a clock that does not
Getting in / Pair 12A code that is wrong against A clock that is wrong
Every code refused can mean a mistyped one or a device whose idea of the time has drifted.
The test: Compare the clock on the code device against a trusted one, down to the seconds
An absence against a single character out of place
Getting in / Pair 13An account that is not there against A name spelled differently
A name that does not exist and a name you are spelling wrong produce the identical refusal.
The test: Read the name you hold against the record you made at the time, one character at a time
A wait somebody planned against a wait nobody did
Getting in / Pair 14A queue against A market that is overloaded
A deliberate holding pattern and the absence of one both leave you staring at a wait.
The test: Ask whether the wait is a page somebody designed or a request that never finished
The habit that saves the most trouble
Stop after the second refusal. Not because a third attempt is dangerous in itself, but because attempts made without new information cannot succeed, and on the side of the pair where a counter is running, they actively make things worse by extending it.
The gap between attempt two and attempt three is where the whole group is decided. Everything useful in this section happens in that gap, and nobody who is annoyed enough to be typing quickly is going to take it unless they decided to in advance.
What none of these pages do
None of them help you get past anything. Working around a rate limit or a captcha is not the subject and there is nothing on the site about it. The subject is knowing which wall you are looking at, so you stop pushing on the one that will not move and wait out the one that will.