2 ms·

This seems like a boon to credential stuffing attacks. Given a list of passwords and email addresses, having a well known, email keyed URL would allow an attack

This seems like a boon to credential stuffing attacks. Given a list of passwords and email addresses, having a well known, email keyed URL would allow an attacker to quickly find if any of the emails have an account on the service, before going through the better secured and more time consuming login page.

edent 3y ago
That's a reasonable point. I wonder if returning a default avatar rather than a 404 would be a reasonable deterrent?
- cs02rm0 3y ago
  Wouldn't they just check for the default avatar then?
  - edent 3y ago
    Twitter used to have a series of different coloured "Egg" avatars for new users. But, yes, this might be useful in enumeration attacks - but so is something like WebFinger. Good points to consider. Thanks!
koliber 3y ago
[dead]