4 ms·

I work on dating sites, some of them a bit risqué. On the password reset form, there's a big difference between saying "That email does not exist in our system

I work on dating sites, some of them a bit risqué. On the password reset form, there's a big difference between saying "That email does not exist in our system"/"Emailed password reset instructions" vs "If that account is registered, we will email you instructions".

MichaelGG 13y ago
Do you setup a timed sleep to make sure that you return results in exactly the same time regardless of path taken?
- broolstoryco 13y ago
  Not sure if sarcasm..
  - nfm 13y ago
    This is a real attack vector. It's called a timing attack: http://en.wikipedia.org/wiki/Timing_attack http://en.wikipedia.org/wiki/Timing_attack
    - broolstoryco 13y ago
      I am familiar with timing attacks. The thought of someone attempting to apply it over the internet to verify whether an email is registered on a dating site seems laughable.
      - MichaelGG 13y ago
        Applying it over the Internet is quite feasible, especially with simple code. If it connects to a remote SMTP server, the delay may very well be noticeable enough without doing any complicated timing. It might be just about as easy as scraping the page for "user not found" versus "email sent". I assume that was the original point - that on risque dating sites, the recover password system tries to hide membership.
- amalcon 13y ago
  For the record, the right way to do this is to just log the request to your database, and have a background process pull the log and take appropriate action later.
unreal37 13y ago
How do you handle users attempting to register a new account with an email address that already exists? If you say, "we don't allow two accounts with the same email address", you have the same issue as coinbase.
- KMag 13y ago
  For the case of people attempting to sign up a second time with the same email address, don't change anything shown from the webpage. Instead of sending a verification email, send an email informing them that someone is trying to sign up again with the same email address, and include an expiring password reset link in that email. If you see too many users forgetting that they've already signed up, and getting frustrated by filling out too much data in forms before finding out they've already signed up, then consider moving the email verification step earlier in the signup process.
  - unreal37 13y ago
    So you'll allow a user to go all the way through the process of registration, create a new password, get temporary access to your site... and then what... not save that password? So a re-login attempt won't work? I can't see how you can avoid making the experience for the duplicate user exactly the same as a new user.
    - KMag 13y ago
      > ... get temporary access to your site... > I can't see how you can avoid making the experience for the duplicate user exactly the same as a new user. The workflow diverges at the email verification step, before you grant any access to the site. Existing users get an email informing them that someone has tried to sign up a second time using their email address while new users get the standard email verification email. I highly recommend not allowing account creation before email address verification. I have a difficult to spell last name, so I have one email address that contains my initials and a common word instead of my last name. You'd be surprised the number of people who don't know their own email address and the number of sites that allow people to sign up (and apparently transact significantly) without verifying email addresses. Off the top of my head, if I wanted to, I could steal one person's tax accounting account (I got confirmation that they filed their state taxes this year, and later confirmation their state accepted their filing), another person's car rental account, and a third person's business's trash service account. From time to time the one person tries to reset their car rental account password. I imagine I could reset the passwords for all of these accounts (and others) and get the last 4 digits of their credit card numbers and other personal information and use that as a starting point for gaining access to other accounts they own. In the case of the tax account, I could probably re-download the tax paperwork and get their SSN. Neither the tax accounting company nor the car rental agency replied when I informed them that accounts were set up with the wrong email addresses. (I also get business quotes from time to time. Hopefully some day I'll get email from a business or person who knows the person who keeps trying to reset their car rental account.) If you have enough users who forget they already have an account and your signup process makes them get too far before verifying their email address, consider moving email verification earlier in your workflow.

MichaelGG 13y ago

Do you setup a timed sleep to make sure that you return results in exactly the same time regardless of path taken?

broolstoryco 13y ago
Not sure if sarcasm..
- nfm 13y ago
  This is a real attack vector. It's called a timing attack: http://en.wikipedia.org/wiki/Timing_attack http://en.wikipedia.org/wiki/Timing_attack
  - broolstoryco 13y ago
    I am familiar with timing attacks. The thought of someone attempting to apply it over the internet to verify whether an email is registered on a dating site seems laughable.
    - MichaelGG 13y ago
      Applying it over the Internet is quite feasible, especially with simple code. If it connects to a remote SMTP server, the delay may very well be noticeable enough without doing any complicated timing. It might be just about as easy as scraping the page for "user not found" versus "email sent". I assume that was the original point - that on risque dating sites, the recover password system tries to hide membership.
amalcon 13y ago
For the record, the right way to do this is to just log the request to your database, and have a background process pull the log and take appropriate action later.

unreal37 13y ago

How do you handle users attempting to register a new account with an email address that already exists? If you say, "we don't allow two accounts with the same email address", you have the same issue as coinbase.

KMag 13y ago
For the case of people attempting to sign up a second time with the same email address, don't change anything shown from the webpage. Instead of sending a verification email, send an email informing them that someone is trying to sign up again with the same email address, and include an expiring password reset link in that email. If you see too many users forgetting that they've already signed up, and getting frustrated by filling out too much data in forms before finding out they've already signed up, then consider moving the email verification step earlier in the signup process.
- unreal37 13y ago
  So you'll allow a user to go all the way through the process of registration, create a new password, get temporary access to your site... and then what... not save that password? So a re-login attempt won't work? I can't see how you can avoid making the experience for the duplicate user exactly the same as a new user.
  - KMag 13y ago
    > ... get temporary access to your site... > I can't see how you can avoid making the experience for the duplicate user exactly the same as a new user. The workflow diverges at the email verification step, before you grant any access to the site. Existing users get an email informing them that someone has tried to sign up a second time using their email address while new users get the standard email verification email. I highly recommend not allowing account creation before email address verification. I have a difficult to spell last name, so I have one email address that contains my initials and a common word instead of my last name. You'd be surprised the number of people who don't know their own email address and the number of sites that allow people to sign up (and apparently transact significantly) without verifying email addresses. Off the top of my head, if I wanted to, I could steal one person's tax accounting account (I got confirmation that they filed their state taxes this year, and later confirmation their state accepted their filing), another person's car rental account, and a third person's business's trash service account. From time to time the one person tries to reset their car rental account password. I imagine I could reset the passwords for all of these accounts (and others) and get the last 4 digits of their credit card numbers and other personal information and use that as a starting point for gaining access to other accounts they own. In the case of the tax account, I could probably re-download the tax paperwork and get their SSN. Neither the tax accounting company nor the car rental agency replied when I informed them that accounts were set up with the wrong email addresses. (I also get business quotes from time to time. Hopefully some day I'll get email from a business or person who knows the person who keeps trying to reset their car rental account.) If you have enough users who forget they already have an account and your signup process makes them get too far before verifying their email address, consider moving email verification earlier in your workflow.