3 ms·

The solution is relatively simple. 1. Email and password for login. Don't tell the attacker which is correct. 2. Email and password for registration. On regis

The solution is relatively simple. 1. Email and password for login. Don't tell the attacker which is correct. 2. Email and password for registration. On registration send confirmation email. If user is already register attacker would need access to their email. Access to email is game over. So now an attacker can't see which users are registered with your service and you've protected your customers privacy. Extra points if your code is aware of timing attacks.

IshKebab 9y ago
Sure but everyone does 1, and not 2, so it's bullshit. Also what is a bigger annoyance? People can slowly use emails to look up if you have an account on a website, or it being a pain in the arse to log in? Except on some sites, e.g. dating websites, this is a stupid theoretical security gain that just pisses everyone off. Like requiring numbers in passwords (basically everyone adds a 1 at the end) or making you change passwords frequently.
tzs 9y ago
> 2. Email and password for registration. On registration send confirmation email. This opens up a different problem. It should be: 2. Email only for tentative registration. On tentative registration, send confirmation email. 3. User clicks link in confirmation email, which takes to page for setting password. (Alternatively, confirmation email includes randomly generated initial password, user is required to change it on first login). After password is set, registration changes from tentative to confirmed. If email and password are both included on the initial registration form, an attacker can try to sign up people and some fraction of those people will accidentally click the link in the confirmation email, thereby resulting in some new accounts where the attacker knows the email and password, and the email owner does not know the password.
- icebraining 9y ago
  You should definitively set the password after clicking the link. That said, what would an attacker do with that account?
  - tzs 9y ago
    Suppose it were a social media site. Now that attacker has a working account with someone else's email address, and that email address is considered verified by the site. The attacker could then use that account to post threats, harass people, and so on. If he goes far enough that either law enforcement wants to come after him or someone wants to sue him and the site is served with a warrant to reveal information about the poster what they are going to cough up is the verified email address of the account holder. That will be followed to the email provider, and from there to the email address holder. The email holder's claims that he never made the social media account are going to sound unconvincing--he clicked the confirm link to make the account! Remember, a civil suit only requires a preponderance of the evidence, not proof beyond a reasonable doubt. That verified email might be enough to reach that standard. In a criminal case it would not be enough...but if the matter was serious enough it might be enough to justify a warrant to search the email address owner's place and computer. At the very least that would be very annoying, and at the worst it could uncover things that the email holder does not want brought to law enforcement attention.
    - icebraining 9y ago
      And all of this activity on the site happens without the site ever sending a single other email besides the account verification, that would tip-off the victim? Color me unconvinced.
- pqh 9y ago
  I feel like my job is to never trust anyone. Don't trust their string encodings, the characters they put into those strings, the arrangements of the characters we do allow, etc.

IshKebab 9y ago

Sure but everyone does 1, and not 2, so it's bullshit. Also what is a bigger annoyance? People can slowly use emails to look up if you have an account on a website, or it being a pain in the arse to log in? Except on some sites, e.g. dating websites, this is a stupid theoretical security gain that just pisses everyone off. Like requiring numbers in passwords (basically everyone adds a 1 at the end) or making you change passwords frequently.

tzs 9y ago

> 2. Email and password for registration. On registration send confirmation email. This opens up a different problem. It should be: 2. Email only for tentative registration. On tentative registration, send confirmation email. 3. User clicks link in confirmation email, which takes to page for setting password. (Alternatively, confirmation email includes randomly generated initial password, user is required to change it on first login). After password is set, registration changes from tentative to confirmed. If email and password are both included on the initial registration form, an attacker can try to sign up people and some fraction of those people will accidentally click the link in the confirmation email, thereby resulting in some new accounts where the attacker knows the email and password, and the email owner does not know the password.

icebraining 9y ago
You should definitively set the password after clicking the link. That said, what would an attacker do with that account?
- tzs 9y ago
  Suppose it were a social media site. Now that attacker has a working account with someone else's email address, and that email address is considered verified by the site. The attacker could then use that account to post threats, harass people, and so on. If he goes far enough that either law enforcement wants to come after him or someone wants to sue him and the site is served with a warrant to reveal information about the poster what they are going to cough up is the verified email address of the account holder. That will be followed to the email provider, and from there to the email address holder. The email holder's claims that he never made the social media account are going to sound unconvincing--he clicked the confirm link to make the account! Remember, a civil suit only requires a preponderance of the evidence, not proof beyond a reasonable doubt. That verified email might be enough to reach that standard. In a criminal case it would not be enough...but if the matter was serious enough it might be enough to justify a warrant to search the email address owner's place and computer. At the very least that would be very annoying, and at the worst it could uncover things that the email holder does not want brought to law enforcement attention.
  - icebraining 9y ago
    And all of this activity on the site happens without the site ever sending a single other email besides the account verification, that would tip-off the victim? Color me unconvinced.
pqh 9y ago
I feel like my job is to never trust anyone. Don't trust their string encodings, the characters they put into those strings, the arrangements of the characters we do allow, etc.