Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If a website has a reset password facility (which will e-mail the account holder a reset link), does this facility reveal too much information by allowing someone to probe who holds an account by entering various e-mail addresses?

On a login screen you can get around it revealing who holds an account by giving a generic "E-mail or password is incorrect" message when incorrect details are entered. Which could mean an account doesn't exist or that the password is wrong.

The only way I can think of not revealing who holds an account through a password reset link is to provide a generic message saying "You have been sent a reset link to your e-mail address, if you had an account, otherwise you'll need to create a new account" or words to that effect, whether or not a reset link could be successfully sent.

share|improve this question
1  
Well.. if you have some sort of an account number, you can ask the user to enter that to retrieve the password. –  hsnm Nov 8 '12 at 11:57
1  
"too much information" is subjective. How much is too much? You seem to be really asking "Is there a way to prevent an adversary from using the reset password facility to enumerate accounts. In which case as @Tobias states, you've answered your own question. –  Mark C. Wallace Nov 8 '12 at 14:27
2  
For a very thorough treatment of your question (and other stuff associated with it,) see Troy Hunt's writeup. It will indeed tell you everything you want to know. –  Jonathan Garber Nov 8 '12 at 14:50
    
@hsnm But then you have to have a process for "I forgot/don't have my account number" and you'll likely end up with the same problem. –  Iszi Nov 8 '12 at 16:45
2  
Unfortunately, if you don't permit duplicate email addresses, your signup screen could be used to do verify them. –  Clockwork-Muse Nov 9 '12 at 0:34
add comment

3 Answers

up vote 5 down vote accepted

You already answered the question youself: The only way to not give away any information is to display a generic "A message has been sent to a@b.c" after requesting a passwort reset, even if there is no account associated with that email. See also this question for additional details.

share|improve this answer
add comment

Yes, could be, but application owner could limit the number of attempts from particular IP-addresses. Another layer could be that entered e-mail address validity could be checked in the application database. Another possibility is to ask e-mail address two times and disable clipboard in the second field, so it always should be typed manually.

Otherwise you are absolutely right.

share|improve this answer
add comment

Are you protecting the bank accounts of people involved in illicit transactions? If so, then permitting an adversary to elicit email addresses/credentials is probably unwise.

Are you protecting my display preferences on a public website? If so, then the "reset password" facility is boring.

As someone else has said, all security controls have a cost; the art is to balance cost, risk, and consequence.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.