5 ms·
The clean code may still have other issues. For example [1] give away if a certain email address is registered with the site or not. [1] https://phppot.com/php
by lixtra 5y ago
The clean code may still have other issues. For example [1] give away if a certain email address is registered with the site or not.
[1] https://phppot.com/php/user-registration-in-php-with-login-form-with-mysql-and-code-download/ https://phppot.com/php/user-registration-in-php-with-login-f...
- IshKebab 5y agoEveryone on HN is obsessed with that "vulnerability" without considering that: a) almost all sites that try to avoid it fail anyway when you try to sign up - "that email is already registered" and b) it's really user-hostile for a tiny increase in privacy so it's perfectly reasonable to not implement it on most sites.
- hsbauauvhabzb 5y agoThis. Risk assess whether user enumeration is actually bad, the go fix it if you need to.
- jffry 5y agoIf I did want to close that hole, is there anything more clever than just having a username that isn't an email address, and allow more than one account to use the same email address?
- ghusbands 5y agoI don't think people in general want to remember a username for every site.
- isbvhodnvemrwvn 5y agoJust return the usual "please confirm registration by clicking a link in the email" - in the e-mail you just notify the email owner that someone tried to create a new account while another account was already registered for this e-mail. This does not disclose anything to anyone other than the owner of the e-mail.
- NavinF 5y agoIMO trying to stop user enumeration is a lost cause. People with many email addresses and no password manager still need a way to figure out which email/username they used on your site. If they can't enumerate themselves, you end up with bad retention or lots of support tickets.
- thrwyoilarticle 5y agoProtecting PII is more important than your user retention.
- NavinF 5y agoToo bad, roughly 0% of websites attempt to stop user enumeration. The ones that try usually fail because they don't do it consistently, but hey the ~0% of their user base that is composed of HNers appreciate the effort. Also, Santa Claus isn't real. When it rains, it pours.