Many advice not to post email addresses on the public forum since some may try for several login attempts using some brute force attacks etc., but I notice in several websites(even in sensitive websites which deal with money) I can find that it uses email-id/username for login mechanisms and they actually display user names publicly, example website GitHub (https://github.com/login?return_to=%2Fpersonal).

My question are these websites vulnerable to a wide range of bruteforce attacks? Like using web crawlers to gather large number of usernames and brute forcing against with a single popular password.

For example "nopassword" is one of the commonly used password by many people Instead of using passwords as wordlists (common method) the attacker could use usernames which are obtained from the bots as wordlists with one single password like "nopassword"

It is narrow spectrum attack but the attacker could gain access to huge number of accounts that use popular passwords by this method. So is this a vulnerability of the websites?

| improve this question | | | | |
  • Re: GitHub, most people's email addresses are publicised through their commit information anyways. – Xiong Chiamiov Nov 19 '16 at 15:49

There is a difference between a 'weakness' and a vulnerability. Usernames are not intended to be secret, so once a username is known, then it is subject to bruteforcing. This is a weakness with the entire username/password model and every website that uses it adopts this weakness.

There are ways to mitigate this weakness, like Two-Factor Authentication (2FA), but the weakness of the model is still inherent.

The problem is that there is no viable alternative that will work for the entire world. Sure, you could issue client certificates, but that is not easy to administer.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.