Timeline for Password reset giving clues of possible valid email addresses
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 20, 2020 at 21:39 | comment | added | GalacticCowboy | @davshowhan449 Although it's still not a great user experience, one way to fix that workflow would be to move any necessary pages to after the user clicks the link in their email. | |
| Mar 20, 2020 at 15:26 | comment | added | Barmar | @davshowhan449 I don't think I've ever seen that in a password reset page. You're presumed to already be a member of the service, there's no need to ask the user to agree to T&C. Other stuff doesn't show up until you respond to the link that's emailed. | |
| S Mar 20, 2020 at 12:59 | history | suggested | TRiG | CC BY-SA 4.0 |
Screen readers will read code one letter at a time. Do not use code formatting inappropriately.
|
| Mar 20, 2020 at 12:51 | review | Suggested edits | |||
| S Mar 20, 2020 at 12:59 | |||||
| Mar 20, 2020 at 9:49 | comment | added | Graipher | @davshowhan449 Then get rid of those additional pages, too. And good riddance, because that sounds like an awful experience in the first place. But maybe that is worth a new question. | |
| Mar 20, 2020 at 8:13 | comment | added | davshowhan449 | what if there are pages that come after? like terms and conditions, notices, FYIs, ads, surveys etc. before the actual sending of email? this could affect user experience. A legit user could say, I went all through that and at the end they didnt tell me my email was invalid? | |
| Mar 19, 2020 at 13:47 | comment | added | Demento | @davshowhan449 - Don't worry, this is a very common vulnerability in web-applications and easily missed. Bad news is, that such issues are actually exploited in the wild and hard to mitigate on short notice, when it happens. Therefore, I recommend fixing it in time, although it is "just an information disclosure" on first glance. | |
| Mar 19, 2020 at 13:43 | comment | added | davshowhan449 | makes total sense. thank you. why didnt I think of that before? | |
| Mar 19, 2020 at 13:39 | history | edited | Demento | CC BY-SA 4.0 |
added 20 characters in body
|
| Mar 19, 2020 at 13:34 | history | answered | Demento | CC BY-SA 4.0 |