81–90 of 289 posts
One way to allow users to register using their email address without leaking any information is to just say "user created, please check your inbox to confirm your email address" or something like that. If the user already exists, swap the confirmation email for a warning email if they already have an account.
Or am I missing something?
> 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. So why not just send an email upon signup with existing email and just show success on signup? I'm guessing email would state that you already have an account there, maybe you need to reset password and…
Already people can chuck a + in the user part and register with the same email like joe+2@gmail.com so really there's not much point trying to maintain a 1:1 user to email ratio.
There is also the question of leaking whether a given user has an account on a website or not. Maybe I don't want my employer to know that I have an account on competitor-service.com, or my partner to know that I have an account on kinky-thing.website. It might not be a security issue, but it could be a privacy issue.
> Unfortunately this assumes that there's no other way for an attacker to discover whether a username/email address is registered for a service. This assumption is incorrect. > 99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address. This point is undermined by…
The contents of the email could be something like "Hey you just tried to register with this email address, but we already have an existing account with this email address ... Was that you? ... Maybe you have forgotten got your password?"
that may explain why my gmail keeps getting signed up for obscure cypto services :(
The best measure? Let any login pass, just generate a fake account if the credentials were wrong.
But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct. The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.
Quoted post unavailable.
Earlier quoted context omitted.
Again, how is that leakage, if you can just try registering a new account and see if that username or email already exists?
Do most people who are throwing usernames and passwords at websites ... do that?
If they don't - then maybe this 'information leakage' worry is obsolete security advice. There's loads of obsolete security advice around.
(of course there might be other, non-account-security-related reasons to make it impossible to know if an account exists. It's one thing if HN's login form reveals that user duxup exists, it's another if find-an-affair-partner.com reveals the same thing)
> Check submitted passwords against a dictionary of common passwords (123456, monkey, etc) and ban that traffic extra hard. > Give guidance to users about creating strong passwords Yeah, if I just want to talk about a propane with some folks I would eagerly wait to be lectured about IT security, scolded at my passwords of choice, go out of my way to appease site administrator's password policy...
This might need (2014) in the title