9

I have a registration portal where user inputs his details and then a valid email account.

Currently I check the email is not used already and if it is I reply with the classic: "email already in use" and something like "recover your old password or create a new account with a new email".

I'm wondering how safe it is this behaviour considering I'm giving away the information that the e-mail address which I inserted is actually available.

How can I make it safer? currently I can only think of preventing brute force checks for available addresses but still the problem remains.

Improve this question
2
  • 1
    You mean that, for example, I could try to register [email protected], then [email protected], then [email protected]..... but gmail will say "Account name already taken.", thereby providing a mechanism to enumerate the entire GMail userbase?
    – Rubber Duck
    Commented Feb 19, 2014 at 12:19
  • exactly, but in my case my userbase is in the order of some thousand addresses and guessing them is much easier as most users use their name and surname on a couple of providers only.
    – dendini
    Commented Feb 20, 2014 at 8:32

2 Answers 2

Reset to default
16

The simplest way to defeat this type of attack is to use a notification email instead of an error message. When someone tries to create an account using an email address respond with "Thank you for registering, an email has been sent to this account for confirmation". From then there's 2 cases:

  • The email is not registered: the email would notify the account holder that a registration attempt has been made using that email address and have links to either confirm the registration, or do nothing and the registration attempt will fail
  • The email is already registered: the email would notify the user that an attempt has been made to register using the email address, and that an account already exists. Give them options to recover their account if it is a legitimate attempt to access. Tell them to do nothing if it is not legitimate

The benefits to this system is that an attacker won't know whether the email has been used in the account or not, the users are notified if someone is attempting to create an account in their name, and you will be notified if someone is trying to discover account information.

Improve this answer
5
  • 5
    As an user, I wouldn't like to receive e-mails from "registration attempts" in my mail. Consider that this could potentially end up with thousands of e-mails from thousands of services telling me "someone have tried to register with this mail" and in fact, that could be me! But even if I am not, what can I do to avoid that? "clicking in a link?" How do I know this is a legit e-mail or a legit business? I think this solution could potentially over complicate sign up processes. I the user will end up marking the e-mail as SPAM.
    – kiBytes
    Commented Feb 19, 2014 at 11:57
  • In the event that the email is already registered, then the new registration should just silently fail.
    – Slicedpan
    Commented Feb 19, 2014 at 12:10
  • 3
    @Slicedpan, if I am already a registered user and I forgot about it then I'd like to be able to recover my account. Silently failing it is poor customer service.
    – GdD
    Commented Feb 19, 2014 at 12:47
  • @kiBytes, That's a good point about the links. The better option would be to say "If this is not legitimate please ignore this email". I've edited to reflect that.
    – GdD
    Commented Feb 19, 2014 at 12:50
  • 1
    @GdD there should be a distinction between resetting password and creating an account. Either way, no indication of success/failure should be shown in the application, and only the reset password action should actually result in an email. (possibly use a captcha for reset to deter automation)
    – Slicedpan
    Commented Feb 19, 2014 at 15:08
1

The attack you're referring to is known as enumeration, where an attacker can determine a list of valid e-mails by trying random ones with your service.

I think for the reasons generated in the other answer's comments: attacks can generate spam against a target by continuously attempting to register as them; or you waste a lot of time filling out the registration form only to be reminded you were already a member.

The balance here I feel is not to pretend the user successfully signed up but rather to implement rate-limiting, so that yes the attack can enumerate e-mail addresses but they may only get 5 attempts to do so, making it worthless whilst maintaining usability for customers.

Improve this answer
6
  • I have added indeed a sleep inside php so that a random amount between 2 and 4 seconds are needed each time: usleep(rand(2000000, 4000000)); this should slow down repeated attempts.
    – dendini
    Commented Feb 20, 2014 at 8:35
  • 1
    By the way, be careful with that you don't make it easy for an attacker to just make an attempt every second, therefore preventing true users from using your service.
    – domen
    Commented Feb 20, 2014 at 14:47
  • @dendini I think you want to programatically do this, not simply sleep on every attempt. It should go as fast as possible until your script decides it's an attacker. Take this to stackoverflow codereview, but from a security perspective, prolonging the life of PHP scripts for a (relatively) very long time opens you up to easy DoS.
    – deed02392
    Commented Feb 20, 2014 at 14:58
  • This does not protect against the issue where someone wants to find out if an email address is already registered with a service, GdD's answer does.
    – Adam Marshall
    Commented Dec 16, 2015 at 13:32
  • @AdamMarshall why is it an issue to find out (maliciously, up to x attempts) if an e-mail address is registered to a service? GdD's answer requires a user who already has an account but has forgotten this to complete every single form field correctly before they are told. The actual pitfalls of enabling a handful of e-mails to be enumerated before rate-limiting are very small.
    – deed02392
    Commented Dec 16, 2015 at 18:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .