4 ms·

Why? I don't see why it's important to hide existence of a user unless you're allowing people to try multiple logins per second on your site. (I'm not an expert

by bo1024 9y ago

Why? I don't see why it's important to hide existence of a user unless you're allowing people to try multiple logins per second on your site. (I'm not an expert so I am sincerely asking to help me understand.)

cdancette 9y ago
If your users want to disclose that information, provide them a way to make a public profile if they want to, and if it makes sense. Don't assume their intentions. They might have good reasons you didn't think of.
avian 9y ago
For some websites, people might not want others to be able to find out whether they have registered if they only know their email address (e.g. same kind of websites for which the incognito/private mode exists in browsers).
rimliu 9y ago
You are leaking the information. Maybe you want to check if your buddy is a registered on some controversial site, or maybe you want to target someone for hacking…
Terr_ 9y ago
We're used to assuming that the attacker knows a login and is guessing at a password, however the opposite scenario is is increasingly common. Suppose another website has a security breach, revealing many names and passwords. User John Doe used a password of "foo", so an attacker starts trying combinations like jdoe/foo or johnd/foo or john_doe/foo, looking for the same person reusing a password on your site. By denying them information about which login names exist, it's harder for the attacker to either zero-in on the correct username (and try alternate password variations) or to be certain that they've got nothing and that it's time to move on.
TranceMan 9y ago
I could find user 'bo1024' has an account on pornhub - not necessarily you and you might not care but certain situations it may be a problem. You could argue it's security through obscurity - I'd say preventing leaking data.
IanCal 9y ago
Very quick examples, if I can check if an email address is registered on a site I can 1. Identify people who are gay/bi (e.g. signed up to grindr) 2. Identify political affiliations (depending on site) 3. Identify health issues (signed up to a mental health forum, or cancer support group, etc) These things people might be happy others knowing, but I hope you can at least see some cases where you might not.
- RamenJunkie_ 9y ago
  You could also potentially build spam email lists too, to target users of that web site, if you automated some system that guessed emails addresses and filed away the ones that come back as registered.
jdietrich 9y ago
Disclosing the existence of a user increases the success rate of certain attacks. Say I've got a leaked password database for foo.com and know that the user bob@gmail.com uses the password "tomato1". If I try using his credentials to log into bar.com and get the message "username or password is incorrect", I'm just going to try the next user on the list. If I get the message "incorrect password", it makes sense for me to try "tomato2", "tomato3" etc. If I know that your password policy requires eight characters and a capital letter, I'm going to try "Tomato11". This is obviously trivial to automate. You can't protect your users against credential-stuffing attacks if they use the same password everywhere, but you can offer them a small layer of protection if they use the same password with minor variations. As others have pointed out, mere disclosure of the existence of an account could be a serious privacy breach in itself.
- mnarayan01 9y ago
  Any evidence of this being used in the wild, particularly where the attack is only trying password variants if the initial failure indicated the user exists? Not disagreeing with the point, just would be interesting if anyone's seen such an attack.
bo1024 9y ago
Just replying to my own post to say thanks everyone who replied (can't edit the original anymore), I learned and got some good food for thought.

by bo1024 9y ago

cdancette 9y ago

If your users want to disclose that information, provide them a way to make a public profile if they want to, and if it makes sense. Don't assume their intentions. They might have good reasons you didn't think of.

avian 9y ago

For some websites, people might not want others to be able to find out whether they have registered if they only know their email address (e.g. same kind of websites for which the incognito/private mode exists in browsers).

rimliu 9y ago

You are leaking the information. Maybe you want to check if your buddy is a registered on some controversial site, or maybe you want to target someone for hacking…

Terr_ 9y ago

We're used to assuming that the attacker knows a login and is guessing at a password, however the opposite scenario is is increasingly common. Suppose another website has a security breach, revealing many names and passwords. User John Doe used a password of "foo", so an attacker starts trying combinations like jdoe/foo or johnd/foo or john_doe/foo, looking for the same person reusing a password on your site. By denying them information about which login names exist, it's harder for the attacker to either zero-in on the correct username (and try alternate password variations) or to be certain that they've got nothing and that it's time to move on.

TranceMan 9y ago

I could find user 'bo1024' has an account on pornhub - not necessarily you and you might not care but certain situations it may be a problem. You could argue it's security through obscurity - I'd say preventing leaking data.

IanCal 9y ago

Very quick examples, if I can check if an email address is registered on a site I can 1. Identify people who are gay/bi (e.g. signed up to grindr) 2. Identify political affiliations (depending on site) 3. Identify health issues (signed up to a mental health forum, or cancer support group, etc) These things people might be happy others knowing, but I hope you can at least see some cases where you might not.

RamenJunkie_ 9y ago
You could also potentially build spam email lists too, to target users of that web site, if you automated some system that guessed emails addresses and filed away the ones that come back as registered.

jdietrich 9y ago

Disclosing the existence of a user increases the success rate of certain attacks. Say I've got a leaked password database for foo.com and know that the user bob@gmail.com uses the password "tomato1". If I try using his credentials to log into bar.com and get the message "username or password is incorrect", I'm just going to try the next user on the list. If I get the message "incorrect password", it makes sense for me to try "tomato2", "tomato3" etc. If I know that your password policy requires eight characters and a capital letter, I'm going to try "Tomato11". This is obviously trivial to automate. You can't protect your users against credential-stuffing attacks if they use the same password everywhere, but you can offer them a small layer of protection if they use the same password with minor variations. As others have pointed out, mere disclosure of the existence of an account could be a serious privacy breach in itself.

mnarayan01 9y ago
Any evidence of this being used in the wild, particularly where the attack is only trying password variants if the initial failure indicated the user exists? Not disagreeing with the point, just would be interesting if anyone's seen such an attack.

bo1024 9y ago

Just replying to my own post to say thanks everyone who replied (can't edit the original anymore), I learned and got some good food for thought.