3 ms·

How would you deal with a registration form that takes a username as a parameter, without leaking whether or not a username is already taken?

skymt 15y ago
I would probably have a CAPTCHA on the form already, to prevent automated signups. Preventing username leakage is a side benefit. An attacker would need to hire a CAPTCHA farm to harvest any significant number of usernames. If you don't want to use a CAPTCHA for regular signups, you can add one to the page dynamically when you see multiple registrations from the same IP address.
- eneveu 15y ago
  Does this mean that you wait until the user submits the whole login form to display an error message if the username is already taken? Do you display a new captcha for each attempt? What about sites that let the user know his username is already taken using AJAX? Should this be avoided too? I like zobzu's idea of using an email as login, though.
ivanr 15y ago
In the response, thank the user for initiating registration and send her an email with a link (and a token) to continue with the process. Of course, the downside is that you're slowing the user down. It's acceptable for the sites that choose to require valid email addresses: if you're going to go there you might as well get it done sooner. You'd also be spamming potential victims, but that may not be that bad, as you'd also be alerting them.
ams6110 15y ago
You could set a cookie after a successful login. If a later attempt fails because of a munged username or password, you could inform the user exactly what the problem was if you know they have logged in successfully before and the username is correct or "close" to the real username (not sure how close is "close enough"). EDIT: oops meant this to be a reply to the GP.
- lmz 15y ago
  But then people would complain that you were tracking them after they've logged out of the website...
zobzu 15y ago
email as login plus emailing him for verification captcha against automation for the spam and if thats too annoying to implement use browserid.org

skymt 15y ago

I would probably have a CAPTCHA on the form already, to prevent automated signups. Preventing username leakage is a side benefit. An attacker would need to hire a CAPTCHA farm to harvest any significant number of usernames. If you don't want to use a CAPTCHA for regular signups, you can add one to the page dynamically when you see multiple registrations from the same IP address.

eneveu 15y ago
Does this mean that you wait until the user submits the whole login form to display an error message if the username is already taken? Do you display a new captcha for each attempt? What about sites that let the user know his username is already taken using AJAX? Should this be avoided too? I like zobzu's idea of using an email as login, though.

ivanr 15y ago

In the response, thank the user for initiating registration and send her an email with a link (and a token) to continue with the process. Of course, the downside is that you're slowing the user down. It's acceptable for the sites that choose to require valid email addresses: if you're going to go there you might as well get it done sooner. You'd also be spamming potential victims, but that may not be that bad, as you'd also be alerting them.

ams6110 15y ago

You could set a cookie after a successful login. If a later attempt fails because of a munged username or password, you could inform the user exactly what the problem was if you know they have logged in successfully before and the username is correct or "close" to the real username (not sure how close is "close enough"). EDIT: oops meant this to be a reply to the GP.

lmz 15y ago
But then people would complain that you were tracking them after they've logged out of the website...

zobzu 15y ago

email as login plus emailing him for verification captcha against automation for the spam and if thats too annoying to implement use browserid.org