4

We are setting up a service on our website allowing users to ask for a new activation link. To ask for a new activation link, the user has to submit his/her email address associated with his/her account.

We can have 2 outputs, depending on which we have to give a confirmation message.

  1. User is registered but account is not active. Confirmation message will be

The activation link has been sent.

  1. User is registered and account is already active. Confirmation message will be

The account is already active. If you have forgotten your password, please click here.

We are having doubts about the second confirmation message. It tells too much about the fact that the account already exists. Are there best practices or security tips regarding these kinds of messages?

Or do you have any suggestions?


Edit 2017.03.17

We have implemented a new solution. No matter the output, we will display the following message:

If you are registered, you will soon receive an email.

However, the email sent will depend on the output:

  • If the account is not active, we will be sending the activation link.
  • If the account is already active, we will be sending an email saying that the account is already active and explaining the "password forgotten" procedure.

This solution seems to be the most appropriate in our situation. If you have any other suggestions, please submit.

  • The real question is if disguising the existence of user accounts improves security. It doesn't. User accounts are assumed to be public. – schroeder Mar 16 '17 at 15:05
  • @schroeder Not in all cases - I bet the users of Ashley Madison weren't counting on their accounts being public, for example... Email addresses are public knowledge, generally, but whether a given user has an account on a specific site isn't always. – Matthew Mar 16 '17 at 15:08
  • 1
    @Matthew Ashley Madison did not use emails as the username .... For this very reason ... – schroeder Mar 16 '17 at 15:14
  • Unfortunately, we are using emails as usernames. No matter what, we will be telling that the account exists. The thing is to be less explicit, I think. – BS_C3 Mar 16 '17 at 15:22
  • Your 2017.03.17 edit looks like an answer, which would let you close this question. – Adam Katz Sep 13 '17 at 14:39
0

Edit 2017.03.17

We have implemented a new solution. No matter the output, we will display the following message:

If you are registered, you will soon receive an email.

However, the email sent will depend on the output:

If the account is not active, we will be sending the activation link.
If the account is already active, we will be sending an email saying that the account is already active and explaining the "password forgotten" procedure.

This solution seems to be the most appropriate in our situation. If you have any other suggestions, please submit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.