3 ms·
password reset flows are generally a privacy leak if you use email as some kind of account key, you can generally find out whether that email has signed up (if
by awinter-py 6y ago
password reset flows are generally a privacy leak
if you use email as some kind of account key, you can generally find out whether that email has signed up (if not the username)
automatic password reset and email verification are good for businesses and users in a lot of ways so this is a tradeoff
if FB is showing the specific account linked to an SMS that's IMO negligent but shrug, they employ more lawyers than I do and they've never been investigated by the FTC for privacy issues
- 52-6F-62 6y agoI’ve seen this obfuscated by some systems by always just throwing the user a message saying the reset email has been sent so that there’s no indication whether or not the email is associated with an account or not. Of course, that doesn’t help someone who can’t remember if they’d signed up or not but it’s probably the safer way to go in general.
- awinter-py 6y agoyup, need to do it in the signup case as well but it solves the problem
- contravariant 6y agoThere's typically a system that forbids you from adding an additional account with the same email though.
- MattGaiser 6y agoCan't you just say that a password reset email has been sent? That is what we did when I worked in banking as a way to prevent this. Whether or not you have an account, the system says a reset email has been sent.
- dasb 6y agoBut then you confuse legitimate users that don't remember what email they signed up with.
- smichel17 6y agoI why not actually always send an email to that address? If the email isn't registered, change the message to suggest that perhaps they signed up with a different email, or they'd like to sign up instead?
- kfarr 6y agoYes this is the correct answer. I've seen some systems respond with "if there's an account registered to this email address you will receive a password reset email" whether or not the address is registered
- zwog 6y agoIn most cases you can find out whether an account with a specific email address exists by trying to sign up with it, though.
- MattGaiser 6y agoFair. We didn't have that issue because you don't sign up for bank accounts online.
- evan_ 6y agoIn most cases attackers can use the signup flow to see if an email is registered so as long as it isn’t less protected (with a captcha etc) it isn’t any more of a privacy leak in that regard.
- Buge 6y agoAre you being sarcastic about the FTC? https://www.ftc.gov/news-events/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions https://www.ftc.gov/news-events/press-releases/2019/07/ftc-i...
- awinter-py 6y agooh yeah other than the one time. but if they had done anything really bad there would have been some kind of 5 billion dollar for the deceptive disclosure and settings and some kind of toothless compliance council involving the board of directors
- Buge 6y agoIt's hard for me to understand what you're saying. I can't tell whether you're saying the FTC has investigated facebook a ton and that means facebook is bad, or that the FTC hasn't investigated facebook enough and that means the FTC is bad.