4 ms·
Actually, many password forget forms do not provide any information about whether the email was recognized or not. More than once I've seen a message along the
by ambrop7 13y ago
Actually, many password forget forms do not provide any information about whether the email was recognized or not. More than once I've seen a message along the lines if "If the email entered was associated with an account, a password reset has been sent.".
EDIT: On the other hand even if the response is always the same, I expect most implementations to be vulnerable to a timing attack ;)
- genwin 13y agoHow would they be vulnerable to a timing attack?
- ambrop7 13y agoSending an email takes more time than not sending an email.
- genwin 13y agoI think I see your point; clever. The site could show the message and only then send the mail asynchronously. I guess that's why you said most implementations.
- MichaelGG 13y agoQueuing up an async message still takes time. As does reading a row from a database and materializing an object. So "most" is really probably nearly all unless they take explicit steps to make sure the same amount of work is performed in either case.
- genwin 13y agoYes, or sleep to elapse a time that's longer than needed to queue up the async message, say half a second, before returning the message to the browser.