3 ms·
The article explains how to do it properly at the end: > To prevent attackers from knowing whether an account exists or not your signup must only take an email
by willvarfar 9y ago
The article explains how to do it properly at the end:
> To prevent attackers from knowing whether an account exists or not your signup must only take an email address and provide no feedback in the UI if the sign up succeeded or not. Instead the user would receive an email saying they’re signed up.
Is this not also part of the various 'best practices'? (I confess I don't read too many of them!)
- tuxxy 9y agoTypically, yes. This post didn't really offer any new insight to this. Maybe it's a PSA? Either way, it completely depends on the site's threat model. In the case of GitHub, it's quite useless because a user can just go to the targets's profile to see if it exists. Thus, it really isn't in GitHub's threat model, obviously. Where it gets really interesting is when you perform user enumeration attacks via timing. IE: it takes the server a few milliseconds longer to send a registration email than to not, or it takes the server longer to try to validate a password hash than to lookup a nonexistent user.
- aglionby 9y agoIs this possible to detect despite external factors (variable latency etc)?
- menacingly 9y agoIt's black magic to me, but I'm paranoid about timing attacks after seeing a few examples in the past of what's possible for a clever attacker to guess if they can gather data from a number of requests.
- aglionby 9y agoI've once tried to sign up for some site (I can't remember which) which went through with the usual successful signup, please check your email text. The email I received however was something along the lines of 'you already have an account with this email!', which seems like the best way of doing things.