8 ms·
Not showing "user not found" errors may not be a strong security measure, but it's an effective and important privacy measure. And while you may think that the
by efsavage 14y ago
Not showing "user not found" errors may not be a strong security measure, but it's an effective and important privacy measure.
And while you may think that the fact that your app isn't a risk because it doesn't deal with sensitive issues, your users may not agree.
- pornel 14y agoIf the site has a registration form, then hiding e-mail in password reset is pointless. Site's registration form validation will give the same information and without side-effects.
- Xylakant 14y agoThat's false for well designed signup forms. Signup forms should never leak "email/username does not exist" but only "this combination of email/username and password is unknown". This prevents the trivial attack. Timing attacks might still be possible, but then at least you're on the same level for both attack vectors.
- mootothemax 14y agoSignup forms should never leak "email/username does not exist" but only "this combination of email/username and password is unknown". Can you explain this to me? Is the only difference the error message used, or are you suggesting that apps should support multiple accounts with the same email/username but with different passwords? Or something else entirely? :) Personally, I don't understand what difference a message makes; it'd be trivial for a user to test by signing up for an account themselves. And not having a unique login identifier would be a nightmare. Which makes me think I'm missing something obvious (damn this headcold, it makes me feel so much more stupid than usual!).
- Xylakant 14y agoI'm sorry, my mistake here. I was thinking login forms. But the same thing can be done with signup forms, as explained in the response to the comment following yours.
- chrisro 14y agoYou're thinking of a login form. If you were to try to register a new account with an email address already in the database, you should get some variation of "A user account with that email address already exists," verifying the existence of an account with that email.
- Xylakant 14y agoYou're right, I was thinking login forms. But the same trick works for signup forms as well: I could get an email to my mailbox "hey, thanks for registering again but you already have an account. If you forgot the password, click here." That plugs that hole. Note that this won't work with usernames, but usernames are far less tied to a specific person than email addresses. (apart from some people that have very specific and well known usernames).
- mootothemax 14y agoBut the same trick works for signup forms as well: I could get an email to my mailbox "hey, thanks for registering again but you already have an account. If you forgot the password, click here." That plugs that hole. But how would that work for users who aren't you? My name is - surprisingly, to me - quite common, and the number of registration signups I receive at my [firstname][lastname]@gmail.com email address is really quite surprising.
- Xylakant 14y agoThe point is that you know that you own your email-address. Nobody else could have registered with that address and (rightfully) expect a confirmation email. If somebody else tries to register in error it's the same as with a fresh account at service x: The mail goes to digital nirwana. So if you suddenly get a flood of "hey, thanks for registering again" mails you'd at least know that somebody is trying to tamper with your account. The email could even say so and add a "please notify us if you think somebody is trying to play tricks on you" link.
- 14y ago
- damoncali 14y agoI have had many users complain about password and login problems. I've had zero users complain about someone being able to figure out they have an account. Sometimes security is important. Other times its just a waste of energy.