5 ms·
Ok, let me see. Back in 2005 a friend sent me one of these crush anonymously. I didn't want to guess on the site who it was, but I wanted to know who it was. T
by chegra 16y ago
Ok, let me see. Back in 2005 a friend sent me one of these crush anonymously. I didn't want to guess on the site who it was, but I wanted to know who it was. They had this feature where you enter your email if you forgot your password. So, I thought to myself, not many of my friends would know about this site and whoever it is was probably the only person of my friends to be on it. So, I enter the list of female friends to recover their passwords[Just finished my undergrad, had loads of free time]. If they weren't on it the site came back with an error message. In the end, I came across one person who it was successful for.
Point being be careful with your error messages they might give away your users anonymity.
- deleted 16y ago[deleted]
- mahmud 16y agoPlease DON'T do that. Don't type people's email addresses into whatever forms you come across online.
- deleted 16y ago[deleted]
- deleted 16y ago[deleted]
- sbov 16y agoAs much as you protest this people will still do this. Coincidentally, this is why I have a separate email address for any site that anyone may look down upon. Figuring out what sort of services you sign up for online is usually as trivial as trying to sign up a new account with your email address. This is also why if my site enforces 1 user per email address, I make sure I do that check only if all other information is valid. In comparison, most sites let you enter a bunch of invalid information but a valid email address and will happily let you know that person already has an account. If you have to enter fully valid information, theres some risk you will sign the user up and let them know someone is using their email address for things.
- bjonathan 16y agoLol ok nice one we gonna fix that like right now :) Thank to your twisted mind :p Thats why I love HN you always find your way around ;)
- daeken 16y agoAvoiding information leakage, whether in terms of error cases (e.g. incorrect padding on crypto showing a different error, leading to a padding oracle attack) or in terms of user-facing content (e.g. exposing whether or not a username or email exists in the system) can be difficult. That said, you should always err on the side of showing a single message rather than multiple -- in this case, always show success. This is common practice in certain things, like always showing "incorrect username or password" rather than "incorrect username" and "incorrect password" messages, but most people don't consider it for other things. The less data you give to users about state that isn't necessarily theirs, the better.
- citricsquid 16y agoEw no, don't always show success, there surely has to be a more elegant solution. I have multiple email addresses and sometimes I'll use a different one for a different service, if I enter email@website.com when I used email@anotherwebsite.com and you show success when it's the wrong one, I'll be waiting for an email that will never appear... Maybe HN can work out a good solution collectively? I can only think of a secondary authentication piece, but then that's also possible to be forgotten.
- gcheong 16y agoHow about show success, but adjust the confirmation e-mail accordingly. For example, if the e-mail address is not registered you could say something like "We received a request to recover your password on our service but see that you are not registered for our service with this e-mail address." ?
- metageek 16y ago
- TheSOB88 16y agoSooo, how'd the relationship turn out?
- kgtm 16y agoIf you're ever going to be her: crazygrl+secretpoke@[...]
- draz 16y agohow do you guarantee that the particular female friend had a crush on you and not on another guy (and just happened to be using the site for him)? :-)