Does correcting misspelled usernames create a security risk?

Question

Does correcting a misspelled username and prompting the user with a valid username introduce a security risk?

I recently tried logging into facebook and misspelled my email. They prompted me with the message below.

Log in as {username}

{email}@gmail.com · Not You?

Please Confirm Password It looks like you entered a slight misspelling of your email or username. We've corrected it for you, but ask that you re-enter your password for added security.

I know usernames aren't really a secret but when a website fixes a misspelling to a correct one, they seem to be taking the 'not a secret' a little too far.

Answer 1

As you said, you saw this on facebook - so I tried these steps:

• Login with [email protected] and real password -> works
• Login with [email protected] and real password -> works, too (!)
• Login with [email protected] and real password -> also works
• Login with [email protected] and real password -> also works
• Login with [email protected] and wrong password -> Wrong password, but email got automatically corrected to the right email
• Login with [email protected] in a private tab (or a browser with cleared cache & cookies) -> "The email you’ve entered doesn’t match any account"

As the correction only seems to work when I have already successfully logged into FB at this PC, I would say that this is not a vulnerability in facebook.

---

Edit: Added new test cases; thanks Zymus, simbabque and Micheal Johnson for the suggestions

Answer 2

Allowing username or email iteration may be a security problem for most sites, but not for Facebook. For sites as large as Facebook, finding emails that have accounts is easy because the sites have so many users. This holds for other huge user databases like Google and Microsoft. These companies just have to be secure in the face of their username/email databases being (sort of) publicly known.

That said, I would be surprised if this was the first time that you were using Facebook with the same browser, computer, or even IP address. It just doesn't make sense for them to complete usernames as any email-looking string is probably close to one or more of their users. I suspect that Facebook had some way of knowing that you were you.

Answer 3

Based on the details you've provided here, I would say "Yes, that is a security risk" because it 100% identifies who is registered on the site. I don't know how many times a request can be submitted before a block is placed (CAPTCHA, IP-block, etc) but an attacker could simply "brute-force" a set of usernames and emails to obtain a pretty clear list of who uses the site.

As it is, the system doesn't tell you which you input incorrectly but a script could tell that pretty quickly by just comparing the before with the after.

Worse yet, with a list of usernames and emails, those because target lists for other sites because (I expect) people tend to reuse usernames (as with email addresses).

Looks pretty questionable imho.

Surprised...would think FB would have better sense than that.