0

I am just wondering your opinions on why it would/would not be a good idea to mask or obfuscate email address data in a password reset web submission once the user has entered their username informing them of where the password reset link was sent to.

Example:

"Your password reset link has been sent to Mar************lky@h******.com If this isn't your address please contact us on 1-800-555-5555."

Large providers, such as Apple and Google, do this to an extent, and I believe it helps users remember what address they set, if they rarely use the service and provides them an opportunity to realize "oh cr@p, I have that old address still!".

Thoughts for pro's and cons would be most welcome!

Improve this question
2
  • 1
    Could you reword this to remove the opinion based aspects? Opinion based questions are off-topic, but there are probably sensible answers to the question "Does providing an obfuscated email address as part of a password reset process open a new attack vector?"
    – Matthew
    Commented May 5, 2016 at 15:08
  • if you have that much personal info being published, perhaps offer a list of 3-5 possible email address, 1 real the others decoy, to provide some level of deniability.
    – dandavis
    Commented May 25, 2016 at 4:26

2 Answers 2

Reset to default
3

I believe they do this in order to prevent spammers from entering random usernames and obtaining a list of email addresses, while still reminding the set address to the legitimate user (who might have more than one account).

I personally don't see any major problem with that. Of course, someone might set up an account with an old email address, forget about it, and forget the password, with no chance of resetting it, but that is not a flaw of this mechanism.

Improve this answer
2

One flaw with this system is that email addresses are often fairly predictable, and a lot of people have email addresses from a relatively small number of providers. This can mean that a targeted attack (spear phishing, for example) can use these type of forms as a way of confirming guesses at email addresses.

For example, a user called John Smith might have the email address [email protected] (from working at Example), and a personal address, which isn't known directly. His Facebook account might allow for the reset password to be sent to "js****@g****.com" - it's a pretty good guess that it is going to be [email protected]. If it offered "j********@h******.com", you can make a pretty good guess at [email protected]. It's much less likely that he will have "[email protected]", unless he is known to work for the domain owner.

You can slightly improve the security from this type of attack by decoupling the length of original address from the length provided in the obfuscated version: "j*@g*.com" and "j*@h*.com" don't offer anywhere near as much information, but are probably enough to hint the legitimate user to where they need to look.

Improve this answer
2
  • True, but if I have two accounts, [email protected] and [email protected], that message doesn't give me any kind of information. I think that email address predictability is a layer 8 problem.
    – A. Darwin
    Commented May 5, 2016 at 15:35
  • Depends which angle to take on it - I do some OSInt work (where I've used this exact method to find email addresses), and had people shocked at how easy it was. Also do functional testing, and had people complain that it should give the whole username and just partially blank out the domain. I'm generally against providing any information without authentication, so would go for the "users should remember email addresses" option, but I use a password safe to remember which one I've used...
    – Matthew
    Commented May 5, 2016 at 15:40

You must log in to answer this question.