Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a registration portal where user inputs his details and then a valid email account.

Currently I check the email is not used already and if it is I reply with the classic: "email already in use" and something like "recover your old password or create a new account with a new email".

I'm wondering how safe it is this behaviour considering I'm giving away the information that the e-mail address which I inserted is actually available.

How can I make it safer? currently I can only think of preventing brute force checks for available addresses but still the problem remains.

share|improve this question
1  
You mean that, for example, I could try to register james@gmail.com, then john@gmail.com, then joe@gmail.com..... but gmail will say "Account name already taken.", thereby providing a mechanism to enumerate the entire GMail userbase? –  Rubber Duck Feb 19 at 12:19
    
exactly, but in my case my userbase is in the order of some thousand addresses and guessing them is much easier as most users use their name and surname on a couple of providers only. –  dendini Feb 20 at 8:32
add comment

2 Answers

up vote 7 down vote accepted

The simplest way to defeat this type of attack is to use a notification email instead of an error message. When someone tries to create an account using an email address respond with "Thank you for registering, an email has been sent to this account for confirmation". From then there's 2 cases:

  • The email is not registered: the email would notify the account holder that a registration attempt has been made using that email address and have links to either confirm the registration, or do nothing and the registration attempt will fail
  • The email is already registered: the email would notify the user that an attempt has been made to register using the email address, and that an account already exists. Give them options to recover their account if it is a legitimate attempt to access. Tell them to do nothing if it is not legitimate

The benefits to this system is that an attacker won't know whether the email has been used in the account or not, the users are notified if someone is attempting to create an account in their name, and you will be notified if someone is trying to discover account information.

share|improve this answer
3  
As an user, I wouldn't like to receive e-mails from "registration attempts" in my mail. Consider that this could potentially end up with thousands of e-mails from thousands of services telling me "someone have tried to register with this mail" and in fact, that could be me! But even if I am not, what can I do to avoid that? "clicking in a link?" How do I know this is a legit e-mail or a legit business? I think this solution could potentially over complicate sign up processes. I the user will end up marking the e-mail as SPAM. –  kiBytes Feb 19 at 11:57
    
In the event that the email is already registered, then the new registration should just silently fail. –  Slicedpan Feb 19 at 12:10
1  
@Slicedpan, if I am already a registered user and I forgot about it then I'd like to be able to recover my account. Silently failing it is poor customer service. –  GdD Feb 19 at 12:47
    
@kiBytes, That's a good point about the links. The better option would be to say "If this is not legitimate please ignore this email". I've edited to reflect that. –  GdD Feb 19 at 12:50
    
@GdD there should be a distinction between resetting password and creating an account. Either way, no indication of success/failure should be shown in the application, and only the reset password action should actually result in an email. (possibly use a captcha for reset to deter automation) –  Slicedpan Feb 19 at 15:08
add comment

The attack you're referring to is known as enumeration, where an attacker can determine a list of valid e-mails by trying random ones with your service.

I think for the reasons generated in the other answer's comments: attacks can generate spam against a target by continuously attempting to register as them; or you waste a lot of time filling out the registration form only to be reminded you were already a member.

The balance here I feel is not to pretend the user successfully signed up but rather to implement rate-limiting, so that yes the attack can enumerate e-mail addresses but they may only get 5 attempts to do so, making it worthless whilst maintaining usability for customers.

share|improve this answer
    
I have added indeed a sleep inside php so that a random amount between 2 and 4 seconds are needed each time: usleep(rand(2000000, 4000000)); this should slow down repeated attempts. –  dendini Feb 20 at 8:35
1  
By the way, be careful with that you don't make it easy for an attacker to just make an attempt every second, therefore preventing true users from using your service. –  domen Feb 20 at 14:47
    
@dendini I think you want to programatically do this, not simply sleep on every attempt. It should go as fast as possible until your script decides it's an attacker. Take this to stackoverflow codereview, but from a security perspective, prolonging the life of PHP scripts for a (relatively) very long time opens you up to easy DoS. –  deed02392 Feb 20 at 14:58
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.