Is there a risk in sending the username in a password reset email?

Question

We're using a CMS that has a password reset function that works according to best practices out of the box.

• Passwords are stored as salted hashes
• Forgot Password works like this:
  • User enters either username or email address in textbox
  • System generates an email with a "reset password" link
  • User has x amount of minutes to follow the link and reset the password, or it's disabled.

(Side note, we would like to add two-factor authentication, and the company that develops this CMS is working on providing that, but as of yet it's not available.)

Optionally, we can include the username in the email in case the user has forgotten their username.

Does including the username in the password reset email result in an added security risk?

Clearly it's one more piece of information an attacker has their hands on, but truth be told, if an attacker manages to intercept this email they can already just click the first link to log in as the user, so I don't really see an added risk. Am I missing anything?

Answer 1

No, there should be absolutely no security risk with this approach.

Usernames are public information and should be treated as such.

EDIT

@Polynomial pointed out a key fact I left out. My advice doesn't apply if the username in question is some piece of sensitive information like a SS number.

Answer 2

This isn't a significant security risk, though it does slightly increase attack surface. It's likely that the usability gain from allowing it greatly outweighs the minuscule risk.

However, it is useful to note that an attacker would gain two things if they were somehow able to intercept a lot of your reset emails:

• The attacker could build a list of valid usernames, to better target bruteforce or birthday attacks on your site.
• The attacker could use the reset token you email the user, or temporary password or whatever.

The second of these would only increase risk if the user was required to provide their username during login, and anyway usernames are frequently guessable from email addresses.

Also, neither of these are a problem at all until an attacker can snoop on your outgoing email, which may be a problem in and of itself. However, SSL/TLS delivery can help prevent this.