Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When we create a Google account, Google tells us whether an account with specified username exists or not.

enter image description here

Doesn't that lead to user enumeration?

Why not let users fill other information first, pass the CAPTCHA test, and then choose the email address after passing the CAPTCHA test? Would this really frustrate users?

share|improve this question
2  
What else could they do? Let you register the address, even if it is already registered by another user? Randomly reject a percentage of usernames in signups even though, they are not already registered? Or simply not letting users have any say in the matter, and just give them a generated address? –  kasperd Aug 6 at 21:09
    
@kasperd they could wait until you've completed the rest of the signup form before telling you. –  immibis Aug 6 at 21:29
2  
@immibis Users will get annoyed, if they have wasted time filling out all of that information, only to be told they cannot have the address they want. Besides, it wouldn't even slow down a bot attempting lots of different addresses. –  kasperd Aug 6 at 21:33
    
@kasperd The question is about security, not usability. The bot would have to create a real email account for every failed enumeration attempt. –  immibis Aug 6 at 21:36
    
@immibis Whoever made such a bot wouldn't mind, if as a side effect lots of email accounts were created. However, keeping querying for names once you have found one, that is available, is suspicious behavior, regardless of whether you register the name or not. So it might very well be easy to detect and block. –  kasperd Aug 6 at 21:42

2 Answers 2

up vote 13 down vote accepted

Email accounts are not private, so there is little risk to discover a certain address. The same thing could be accomplished by sending an email to random accounts and see what bounces back.

Email account enumeration is not the risk as much as true user enumeration is.

share|improve this answer
    
Why not let users fill other information first, pass the CAPTCHA test, and then choose the email address after passing the CAPTCHA test? –  Engineer Aug 7 at 10:51

Yes, but not efficient user enumeration if they rate limit requests, require evidence of humanity, or lie with increasing probability after a number of requests.

Besides, most large webmail systems rely on heuristic spam filters instead of the unguessability of email addresses to limit the amount of spam that reaches your inbox.

share|improve this answer
    
i did not get what you mean by efficient user enumeration –  Engineer Aug 6 at 16:40
1  
@Engineer, If the cost of enumerating the n-th email address by this method is less than the benefit that comes from knowing the email address, then an attacker can profit from doing so. If enumerating is hard/inefficient, then there are fewer attackers who would benefit so the system is less vulnerable. –  Mike Samuel Aug 6 at 16:50
    
Why not let users fill other information first, pass the CAPTCHA test, and then choose the email address after passing the CAPTCHA test? –  Engineer Aug 7 at 10:52
    
@Engineer, as schroeder points out, email accounts are not private, so there's little gain, and early captchas might lead to fewer legitimate account creations because users might be more willing to do a captcha after they're invested in a name they've chosen. –  Mike Samuel Aug 7 at 11:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.