3 ms·
> 6. Show useful error messages > We couldn't find an account with that email. Don't do that. It allows for user enumeration.
by willcipriano 6y ago
> 6. Show useful error messages
> We couldn't find an account with that email.
Don't do that. It allows for user enumeration.
- ketzo 6y agoI like "We couldn't find an account matching that email and password." as a default response for any authentication error for this reason. It's less helpful than it could be, but it prevents any kind of enumeration.
- brilee 6y agoThe "register account" flow also allows for user enumeration, but you don't hear people complaining about that security hole.
- amenghra 6y agoRegistration, login, or password reset flows commonly leak directly or indirectly (eg via a timing channel) whether a user exists or not.