Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We're using a CMS that has a password reset function that works according to best practices out of the box.

  • Passwords are stored as salted hashes
  • Forgot Password works like this:
    • User enters either username or email address in textbox
    • System generates an email with a "reset password" link
    • User has x amount of minutes to follow the link and reset the password, or it's disabled.

(Side note, we would like to add two-factor authentication, and the company that develops this CMS is working on providing that, but as of yet it's not available.)

Optionally, we can include the username in the email in case the user has forgotten their username.

Does including the username in the password reset email result in an added security risk?

Clearly it's one more piece of information an attacker has their hands on, but truth be told, if an attacker manages to intercept this email they can already just click the first link to log in as the user, so I don't really see an added risk. Am I missing anything?

share|improve this question
3  
Just as a side note (for you or for anybody else), I don't think it was a good idea to reveal the whole password reset URL. This message looks like it was produced by Kentico CMS. With a quick search it's possible to find results associating your name with the product and potentially revealing the website where the application is hosted. This might be an intranet or dev. project, I don't know, but it's generally not a good idea. –  Adnan Jun 20 '13 at 14:20
    
@Adnan - Thank you. I'll bear that in mind inthe future. –  David Stratton Jun 20 '13 at 14:24
    
Is any part of the reset URL a signed string of which the username is a large part? Hopefully not. –  Mike Samuel Jun 20 '13 at 14:53
    
@MikeSamuel - no. And for the record, this particular sit isn't live or even exposed to the public yet. By the time it is, the password reset url would have long since been expired, but Adnan was right. That was foolish. –  David Stratton Jun 20 '13 at 17:13

2 Answers 2

up vote 9 down vote accepted

No, there should be absolutely no security risk with this approach.

Usernames are public information and should be treated as such.

EDIT

@Polynomial pointed out a key fact I left out. My advice doesn't apply if the username in question is some piece of sensitive information like a SS number.

share|improve this answer
6  
Usernames are public information as long as they aren't PII. Keep in mind that some places use NI / SS numbers or other sensitive attributes for usernames, so this "it's public information" advice shouldn't be considered universal. –  Polynomial Jun 20 '13 at 14:13
    
@Polynomial That is a good point. I didn't take that into account. :) –  Terry Chia Jun 20 '13 at 14:14

This isn't a significant security risk, though it does slightly increase attack surface. It's likely that the usability gain from allowing it greatly outweighs the minuscule risk.

However, it is useful to note that an attacker would gain two things if they were somehow able to intercept a lot of your reset emails:

  • The attacker could build a list of valid usernames, to better target bruteforce or birthday attacks on your site.
  • The attacker could use the reset token you email the user, or temporary password or whatever.

The second of these would only increase risk if the user was required to provide their username during login, and anyway usernames are frequently guessable from email addresses.

Also, neither of these are a problem at all until an attacker can snoop on your outgoing email, which may be a problem in and of itself. However, SSL/TLS delivery can help prevent this.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.