3 ms·
Maybe another term would be better, but it is in common use (example: https://www.owasp.org/index.php/Testing_for_Account_Enumeration_and_Guessable_User_Account
by minitech 10y ago
Maybe another term would be better, but it is in common use (example: https://www.owasp.org/index.php/Testing_for_Account_Enumeration_and_Guessable_User_Account_(OTG-IDENT-004) https://www.owasp.org/index.php/Testing_for_Account_Enumerat...), possibly because usernames aren't meant to be resistant to brute force.
- runesoerensen 10y ago> because usernames aren't meant to be resistant to brute force Any particular reason for saying this? User/account/email enumeration usually involve brute force AFAIK, so lack of resistance would leave a system vulnerable to such attacks.
- minitech 10y agoUsernames are low-entropy human-readable identifiers. If you're getting at login rate limiting and other best practices regarding how things should be: right! That's why it's a term for a vulnerability.
- runesoerensen 10y agoYou're right - I thought you were referring to an authentication system's resistance against username enumeration (rather than the actual username). Thanks for clarifying!