2 ms·
So for the Quora login form that determines whether someone's email address has already registered on the system... What's to stop me from: - looking at the sou
by typicalrunt 15y ago
So for the Quora login form that determines whether someone's email address has already registered on the system... What's to stop me from:
- looking at the source code,
- finding the JavaScript call to the REST service that checks for an account
- writing a script to loop through all well-known domains and usernames?
Tada! Instant email scraping tool.
- typicalrunt 15y agoActually, I re-read the article just to make sure that I wasn't being too critical. I'm not. The author doesn't mention any security risks/benefits associated with the new login form designs. It reminds me of the time when a former boss asked me to add authentication onto the company intranet. She wanted to know who is logging in and viewing private documents, but she didn't like typing in or remembering passwords so I could only ask users for their username and "trust" that they wouldn't type in someone else's username instead. For some (probably most) users, security isn't on the forefront of their mind, so they need to be reminded of it.