4 ms·

I can't argue with the lack of password manager support. But I know where Product is coming from on these approaches. Asking for an email address on its own scr

I can't argue with the lack of password manager support. But I know where Product is coming from on these approaches. Asking for an email address on its own screen allows the form to check whether you have an existing account or need to set up a new one. You avoid a link that says "Don't have an account, Register Here". Is it worth it? I suppose it's subjective. Maybe the designer thinks that is a good reduction in friction. Probably more compelling is that the form can pick up your email domain and redirect to Single Sign On if the domain is known.

etxm 8y ago
Is there no longer a panic over letting an attacker know that an account does exist? I remember that being a thing for a while, but haven’t built user facing UI systems in a few years.
- nevir 8y ago
  It's still a concern, but often forgotten.
- reificator 8y ago
  I haven't heard an update on that front for many years, so I'd assume it should still be a concern. Many of the same sites that do this will also have a recovery form that refuses to leak information.
  - etxm 8y ago
    That’s important. I find it funny[1] when you get the “email does not exist” error on a password reset page. [1] by “funny” I mean not funny
    - reaperducer 8y ago
      I wonder if that's a way for spammers to harvest known good e-mail addresses.
      - scarejunba 8y ago
        Those are available for free on the internet dude. This is a non-concern. The bad guys don't listen to GDPR. There are entire email lists available.
        dbdjfjrjvebd 8y ago
        And how are such lists constructed?
        scarejunba 8y ago
        You just breach someone with a lot of them.
        dbdjfjrjvebd 8y ago
        Would it not be easier/more legal to scrape them using leaky login forms?
        scarejunba 8y ago
        I believe the breached lists rapidly become public. You can find them on the internet.
- tln 8y ago
  It's a tradeoff between security and usability https://security.stackexchange.com/questions/158075/is-it-unsafe-to-show-message-that-username-account-does-not-exist-at-login https://security.stackexchange.com/questions/158075/is-it-un...
- nickles 8y ago
  > Is there no longer a panic over letting an attacker know that an account does exist? There's simply no way to get around this if users can pick their own usernames (other than assigning them in an unpredictable manner). In other cases, usernames being publicly available is a feature, not a bug. [0] https://imgur.com/a/qCupYyQ https://imgur.com/a/qCupYyQ
  - etxm 8y ago
    It’s difficult for an email system, but for other systems this can be solved by having a “display name” and a login (which may be your email).
    - nickles 8y ago
      > this can be solved by having a “display name” and a login You have three choices with a user specified login name. You can: (1) notify a user why account creation has failed (due to a duplicated login name) (2) fail silently and have frustrated users leave your account creation page (3) allow duplicated login credentials In my mind, (2) and (3) are worse than (1). Since the question regards security practices, obfuscating the login name with a display name does not mitigate this vulnerability. If you rate limit the account creation endpoint, you will minimize the ability of an attacker to brute force all usernames of your service, but you cannot prevent an attacker from determining if a specific account exists (apart from assigning login credentials).
      - etxm 8y ago
        Oh good point. I forgot about the whole sign up validation portion :)
- xemdetia 8y ago
  For things that are pentested/audited to some level of compliance standard this is still very much known. It's under the heading of the error message gives too much away.
NLips 8y ago
That's a security failing - you shouldn't let the website user know that a given account exists. The right way to do this is have a log in form (one or two pages - doesn't matter) and a separate create account form. You can try to log into a non-existant account, which will fail in exactly the same way as a wrong password. You can try to create an already existing account, which will result in exactly the same behaviour to the webpage user as creating a non-existing account - a page saying "An email has been sent to the email address <foo>".
- nickles 8y ago
  > That's a security failing - you shouldn't let the website user know that a given account exists. It's not an issue if you let users pick their own username. There's simply no way to get around this (apart from assigning usernames). In other cases, usernames being publicly available is a desired feature. [0] https://imgur.com/a/qCupYyQ https://imgur.com/a/qCupYyQ
- astura 8y ago
  It really depends on what the site is and what the user ID is. For example, I know the account "NLips" exists on hacker news, that's not a "security failing," nor can that information be hidden, however, it would be a security issue if I could put my boss's email into a porn site to see if he has an account.
lowercased 8y ago
> Maybe the designer thinks that is a good reduction in friction. Maybe the designer should use the site as many of their users use it, and realize the inconvenience it causes people (broken password managers, bad browser experience in general, etc).

etxm 8y ago

Is there no longer a panic over letting an attacker know that an account does exist? I remember that being a thing for a while, but haven’t built user facing UI systems in a few years.

nevir 8y ago
It's still a concern, but often forgotten.
reificator 8y ago
I haven't heard an update on that front for many years, so I'd assume it should still be a concern. Many of the same sites that do this will also have a recovery form that refuses to leak information.
- etxm 8y ago
  That’s important. I find it funny[1] when you get the “email does not exist” error on a password reset page. [1] by “funny” I mean not funny
  - reaperducer 8y ago
    I wonder if that's a way for spammers to harvest known good e-mail addresses.
    - scarejunba 8y ago
      Those are available for free on the internet dude. This is a non-concern. The bad guys don't listen to GDPR. There are entire email lists available.
      - dbdjfjrjvebd 8y ago
        And how are such lists constructed?
        scarejunba 8y ago
        You just breach someone with a lot of them.
        dbdjfjrjvebd 8y ago
        Would it not be easier/more legal to scrape them using leaky login forms?
        scarejunba 8y ago
        I believe the breached lists rapidly become public. You can find them on the internet.
tln 8y ago
It's a tradeoff between security and usability https://security.stackexchange.com/questions/158075/is-it-unsafe-to-show-message-that-username-account-does-not-exist-at-login https://security.stackexchange.com/questions/158075/is-it-un...
nickles 8y ago
> Is there no longer a panic over letting an attacker know that an account does exist? There's simply no way to get around this if users can pick their own usernames (other than assigning them in an unpredictable manner). In other cases, usernames being publicly available is a feature, not a bug. [0] https://imgur.com/a/qCupYyQ https://imgur.com/a/qCupYyQ
- etxm 8y ago
  It’s difficult for an email system, but for other systems this can be solved by having a “display name” and a login (which may be your email).
  - nickles 8y ago
    > this can be solved by having a “display name” and a login You have three choices with a user specified login name. You can: (1) notify a user why account creation has failed (due to a duplicated login name) (2) fail silently and have frustrated users leave your account creation page (3) allow duplicated login credentials In my mind, (2) and (3) are worse than (1). Since the question regards security practices, obfuscating the login name with a display name does not mitigate this vulnerability. If you rate limit the account creation endpoint, you will minimize the ability of an attacker to brute force all usernames of your service, but you cannot prevent an attacker from determining if a specific account exists (apart from assigning login credentials).
    - etxm 8y ago
      Oh good point. I forgot about the whole sign up validation portion :)
xemdetia 8y ago
For things that are pentested/audited to some level of compliance standard this is still very much known. It's under the heading of the error message gives too much away.

NLips 8y ago

That's a security failing - you shouldn't let the website user know that a given account exists. The right way to do this is have a log in form (one or two pages - doesn't matter) and a separate create account form. You can try to log into a non-existant account, which will fail in exactly the same way as a wrong password. You can try to create an already existing account, which will result in exactly the same behaviour to the webpage user as creating a non-existing account - a page saying "An email has been sent to the email address <foo>".

nickles 8y ago
> That's a security failing - you shouldn't let the website user know that a given account exists. It's not an issue if you let users pick their own username. There's simply no way to get around this (apart from assigning usernames). In other cases, usernames being publicly available is a desired feature. [0] https://imgur.com/a/qCupYyQ https://imgur.com/a/qCupYyQ
astura 8y ago
It really depends on what the site is and what the user ID is. For example, I know the account "NLips" exists on hacker news, that's not a "security failing," nor can that information be hidden, however, it would be a security issue if I could put my boss's email into a porn site to see if he has an account.

lowercased 8y ago

> Maybe the designer thinks that is a good reduction in friction. Maybe the designer should use the site as many of their users use it, and realize the inconvenience it causes people (broken password managers, bad browser experience in general, etc).