A technique used on websites that leak information on whether a given user exists or not, to get ahold of a list of users who are registered on the website.

learn more… | top users | synonyms

3
votes
1answer
113 views

Why do several bug bounties ignore user enumeration?

While viewing bug bounties, I noticed that most of the bug bounties list the user enumeration in the excluding list. For instance brute forcing user accounts, forget password forms would generally ...
62
votes
3answers
9k views

Does correcting misspelled usernames create a security risk?

Does correcting a misspelled username and prompting the user with a valid username introduce a security risk? I recently tried logging into facebook and misspelled my email. They prompted me with ...
4
votes
1answer
89 views

Informative error messages in password reset functionality?

When I am implementing password reset functionality I usually do not include informative messages about whether a user was found, because I have always believed that it can lead to user name ...
4
votes
1answer
95 views

Does providing non existant users with fake salts prevent user enumeration?

Background I'm currently setting up a basic username & hash based login process for a web application. The process consist of the following steps: User submits their username. Server responds ...
14
votes
7answers
967 views

Mitigate timing attack threat against password recovery page

We recently had an external security review performed on a public-facing website we manage. They noted that on the "recover password page", there are different response times when providing existing ...
6
votes
6answers
156 views

Forgot password and revealing whether account exists [duplicate]

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets; Notify the user whether or not the ...
1
vote
0answers
53 views

Low-resolution account enumeration with Office365

I am interested in the intersection of account enumeration and single sign-on. Often, there will be SSO-only and non-SSO users alongside each other in an application, and in terms of improved ...
82
votes
10answers
13k views

New Gmail login system—going against conventional wisdom?

I noticed that the new gmail login asks for username first, and then confirms if such username exists, before asking for password input. Does this not go against conventional security wisdom to not ...
1
vote
2answers
198 views

Having a consistent “don't reveal email addresses of members” policy [duplicate]

Developers are dogmatic on having "invalid username or password" on login screens; our applications should not reveal if somebody is a member given an email address. But there are two other ways our ...
5
votes
5answers
1k views

Preventing User Enumeration on Registration Page

You have a website that users log into, and you want to prevent user enumeration. On the login page and the forgotten password page, this can be achieved by careful choice of user messages, but what ...
9
votes
2answers
1k views

User Enumeration Vulnerability while creating Google account

When we create a Google account, Google tells us whether an account with specified username exists or not. Doesn't that lead to user enumeration? Why not let users fill other information first, ...
11
votes
4answers
6k views

User name enumeration?

From what I understand it is bad security practice to display informative failed login messages like: The email you entered does not exist Instead of Incorrect email/password combination ...
37
votes
4answers
5k views

Disclose to user if account exists?

Someone told me it shouldn't be possible for someone to detect if a certain email address is used by a registered user on a website. So, for instance, when the user asks to reset his password, you ...
5
votes
1answer
230 views

CAPTCHA enough to thwart user enumeration?

Say I have a site that has a user registration process where, when a user enters an email address already in use, an error message is displayed telling them that. This seems like a easy way to a ...