3 ms·
I'm going to speak strongly against the prevailing view in the security community here: a forgot password email/username oracle is not an issue. Not in any way
by daeken 13y ago
I'm going to speak strongly against the prevailing view in the security community here: a forgot password email/username oracle is not an issue. Not in any way, shape, or form.
Why? Because if I go to register an account with a given email or username, it's going to tell me if that account is already registered! Unless you make multiple accounts with a given username/email possible (please, please don't do that), the forgot password oracle is a non-issue.
You lose absolutely nothing by saying "this email does not exist", and you gain a tremendous amount of user friendliness.
- jasonlotito 13y agoI've never thought of that approach, and of course, how to go about limiting that as an attack vector. We so often try to make it as easy as possible to signup, we forget to think of it as a potential security leak. Thanks for this insight.
- xyzzyz 13y agoHow about this: when you register an account with an already existing email, the website returns the same message as it would if the email didn't already exist: "The account have been created, but needs to be activated. Click on the link in the activation email that has been sent to your email address.". Now, the email that is actually sent says "Someone tried to create an account with your email address. If it was you, we remind you that you already have an account at our website". If the email does not exist, then usual activation email is sent. This way, we don't leak the emails of registered users. If we use emails as usernames, we don't leak usernames either.
- shabble 13y agoThis does seem like a reasonable approach, but would definitely need a rate-limiting system/opt-out to avoid intentional activate-mail DoS to the actual address owner. Might also help whoever has foo@bar.com and similar, too.