The tag has no wiki summary.

learn more… | top users | synonyms

74
votes
9answers
11k views

New Gmail login system—going against conventional wisdom?

I noticed that the new gmail login asks for username first, and then confirms if such username exists, before asking for password input. Does this not go against conventional security wisdom to not ...
3
votes
4answers
376 views

Preventing User Enumeration on Registration Page

You have a website that users log into, and you want to prevent user enumeration. On the login page and the forgotten password page, this can be achieved by careful choice of user messages, but what ...
9
votes
2answers
1k views

User Enumeration Vulnerability while creating Google account

When we create a Google account, Google tells us whether an account with specified username exists or not. Doesn't that lead to user enumeration? Why not let users fill other information first, ...
6
votes
3answers
4k views

User name enumeration?

From what I understand it is bad security practice to display informative failed login messages like: The email you entered does not exist Instead of Incorrect email/password combination ...
5
votes
1answer
178 views

CAPTCHA enough to thwart user enumeration?

Say I have a site that has a user registration process where, when a user enters an email address already in use, an error message is displayed telling them that. This seems like a easy way to a ...