1

Say that I have a website that allows for a user to reset his password through either email or via text message. The user should be allowed to choose one or the other.

Without giving away too much information, what would be the optimal amount of characters to display for a phone number and for an email address to allow the user to reset their password?

Most sites that I've come across don't display emails at all (knowing only a few characters could help an attacker link an email to an account), and just send a reset email silently. But phone numbers seem to be treated differently, as sites tend to display at least part of phone numbers, often using the last two characters of the number like so: (***)-***-**55

Is this the best convention to follow in terms of balancing usability and security? Why do websites display any part of a phone number when they don't display emails, and is there any associated risk with displaying that the user has a phone and/or email connected to their account in the first place?

Improve this question
1
  • users probably fake phone #s more than email, especially if email is validated. also, TXTs cost money, and a "wrong number" will likely send to someone, whereas bad emails bounce back.
    – dandavis
    Aug 17, 2016 at 21:02

1 Answer 1

Reset to default
1

This is all based upon the design of the website.

E-mail address is commonly used for username for your account. So, if the website exposed few characters from the e-mail address then it's few less characters to brute force. If the website does not use e-mail for account name then it's narrows down attack for social engineer or other forms of attacks.

Phone number is not commonly used for the username, so exposing this doesn't have an direct threat towards compromising an account on the website.

Improve this answer
1
  • I understand your point with emails, but I would disagree with phone numbers. Although it may not be a direct threat, if someone could bruteforce the reset password page and record every phone number, they could figure out someone's username if they know their number
    – Verbal Kint
    Aug 18, 2016 at 12:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .