Timeline for E-mail already in use exploit
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 16, 2015 at 18:51 | comment | added | Adam Marshall | @deed02392 the poster said "I'm wondering how safe it is this behaviour considering I'm giving away the information that the e-mail address which I inserted is actually available.", your answer says "not to pretend the user successfully signed up" which means it only defends against the brute force element of the attack | |
| Dec 16, 2015 at 18:16 | comment | added | deed02392 | @AdamMarshall why is it an issue to find out (maliciously, up to x attempts) if an e-mail address is registered to a service? GdD's answer requires a user who already has an account but has forgotten this to complete every single form field correctly before they are told. The actual pitfalls of enabling a handful of e-mails to be enumerated before rate-limiting are very small. | |
| Dec 16, 2015 at 13:32 | comment | added | Adam Marshall | This does not protect against the issue where someone wants to find out if an email address is already registered with a service, GdD's answer does. | |
| Feb 20, 2014 at 14:58 | comment | added | deed02392 | @dendini I think you want to programatically do this, not simply sleep on every attempt. It should go as fast as possible until your script decides it's an attacker. Take this to stackoverflow codereview, but from a security perspective, prolonging the life of PHP scripts for a (relatively) very long time opens you up to easy DoS. | |
| Feb 20, 2014 at 14:47 | comment | added | domen | By the way, be careful with that you don't make it easy for an attacker to just make an attempt every second, therefore preventing true users from using your service. | |
| Feb 20, 2014 at 8:35 | comment | added | dendini | I have added indeed a sleep inside php so that a random amount between 2 and 4 seconds are needed each time: usleep(rand(2000000, 4000000)); this should slow down repeated attempts. | |
| Feb 19, 2014 at 16:50 | history | answered | deed02392 | CC BY-SA 3.0 |