Merge IDNT-04 & IDNT-05?

[tarasovkraud]

Hey! Please explain why WSTG-IDNT-05 is separated from WSTG-IDNT-04? Is a strict account format in a web application (eg John Doe - j.doe) is a vulnerability?

[kingthorin]

• 04 deals with account enumeration (ex: being able to figure out account names based on error message, known accounts (admin, Administrator) etc).
• 05 deals with patterning in account names (ex: first 5 char of last name plus 1 char of first name, phonenumber, student number, etc)

They definitely overlap, and could probably be combine for v5.

[github-actions]

Please comment if you are still working on this issue, as it has been inactive for 90 days. To give everyone a chance to contribute, we are releasing it to new contributors.

[github-actions]

Please comment if you are still working on this issue, as it has been inactive for 90 days. To give everyone a chance to contribute, we are releasing it to new contributors.