4 ms·
Is there no longer a panic over letting an attacker know that an account does exist? I remember that being a thing for a while, but haven’t built user facing U
by etxm 8y ago
Is there no longer a panic over letting an attacker know that an account does exist?
I remember that being a thing for a while, but haven’t built user facing UI systems in a few years.
- nevir 8y agoIt's still a concern, but often forgotten.
- reificator 8y agoI haven't heard an update on that front for many years, so I'd assume it should still be a concern. Many of the same sites that do this will also have a recovery form that refuses to leak information.
- etxm 8y agoThat’s important. I find it funny[1] when you get the “email does not exist” error on a password reset page. [1] by “funny” I mean not funny
- reaperducer 8y agoI wonder if that's a way for spammers to harvest known good e-mail addresses.
- scarejunba 8y agoThose are available for free on the internet dude. This is a non-concern. The bad guys don't listen to GDPR. There are entire email lists available.
- dbdjfjrjvebd 8y agoAnd how are such lists constructed?
- scarejunba 8y agoYou just breach someone with a lot of them.
- dbdjfjrjvebd 8y agoWould it not be easier/more legal to scrape them using leaky login forms?
- scarejunba 8y agoI believe the breached lists rapidly become public. You can find them on the internet.
- tln 8y agoIt's a tradeoff between security and usability https://security.stackexchange.com/questions/158075/is-it-unsafe-to-show-message-that-username-account-does-not-exist-at-login https://security.stackexchange.com/questions/158075/is-it-un...
- nickles 8y ago> Is there no longer a panic over letting an attacker know that an account does exist? There's simply no way to get around this if users can pick their own usernames (other than assigning them in an unpredictable manner). In other cases, usernames being publicly available is a feature, not a bug. [0] https://imgur.com/a/qCupYyQ https://imgur.com/a/qCupYyQ
- etxm 8y agoIt’s difficult for an email system, but for other systems this can be solved by having a “display name” and a login (which may be your email).
- nickles 8y ago> this can be solved by having a “display name” and a login You have three choices with a user specified login name. You can: (1) notify a user why account creation has failed (due to a duplicated login name) (2) fail silently and have frustrated users leave your account creation page (3) allow duplicated login credentials In my mind, (2) and (3) are worse than (1). Since the question regards security practices, obfuscating the login name with a display name does not mitigate this vulnerability. If you rate limit the account creation endpoint, you will minimize the ability of an attacker to brute force all usernames of your service, but you cannot prevent an attacker from determining if a specific account exists (apart from assigning login credentials).
- etxm 8y agoOh good point. I forgot about the whole sign up validation portion :)
- xemdetia 8y agoFor things that are pentested/audited to some level of compliance standard this is still very much known. It's under the heading of the error message gives too much away.