18 ms·
It would be great if article would mention a potential security issue with this approach: two-page login forms, which have any conditional logic based on the pr
by ivan_gammel 7y ago
It would be great if article would mention a potential security issue with this approach: two-page login forms, which have any conditional logic based on the provided username, may leak the information about existence of that username. This opens possibilities for social engineering attacks (“pay $100500 or we’ll tell your wife that you are registered on the dating website”).
EDIT: updated my comment to reflect that conditional logic may expose existence of account, but does not necessarily do it.
- dchest 7y agoYou can't avoid it, username existence is easy to check by trying to register an account. The only solution against the problem you described is to use usernames, which are freely chosen by the user or generated by the website automatically, not email addresses, so that people can create accounts not tied to their identity. Also, two-step form doesn't mean that you have to check username existence after the first step. But, again, this is useless as mentioned above.
- ivan_gammel 7y agoIt’s not always like that. For non-digital businesses account registration flow can be significantly different and not accessible for random visitors. E.g. healthcare provider may provide online access to patient file only after the first appointment.