(How) should we mitigate error code exploits?

[henbos]

As pointed out here, error codes that help distinguish between "wrong credentials" and generic network error might help an attacker for example brute-forcing credentials.

pc.onicecandidateerror is an example of this.

What should we do?

[henbos]

CC @alvestrand who I believe already did some port filtering for similar problems

[juberti]

Do we do this for 401 in fetch/XHR? Seems like it reduces debugging ability and may not be all that effective.

Generally, we should understand the threat model here before trying to come up with a solution.

[aboba]

Closing. We should reopen if we have a specific concern.

[jan-ivar]

I've made the subject more specific and reopened it.