Skip to main content
4 events
when toggle format what by license comment
Jan 2, 2018 at 21:04 comment added Kat Don't you have to check for duplicates when the account is created, period? You can reduce user enumeration (if that's even a worry) with forced delays, but there's a reason most sites treat usernames as public information. I'm not sure I understand how it's easier to do social engineering attacks if you can change usernames. I assume you're thinking of people taking someone's old name? That should be entirely preventable, though, by treating that name as taken (can be either an alias or treated like a deleted account).
Dec 20, 2017 at 18:45 comment added Dan Landberg It was just an example. The point I was trying to make is that the more complex your processes/code are, the more likely you are to make mistakes. It could just as easily be a SQL injection vulnerability in the duplicate check, or a target for CSRF, or any other bug.
Dec 19, 2017 at 21:47 comment added ste-fu Curious how enumeration is a problem if it is a user chosen username as opposed to an email address. Guess users choosing to use their email addresses could count...
Dec 19, 2017 at 21:35 history answered Dan Landberg CC BY-SA 3.0