4

We are setting up a service on our website allowing users to ask for a new activation link. To ask for a new activation link, the user has to submit his/her email address associated with his/her account.

We can have 2 outputs, depending on which we have to give a confirmation message.

  1. User is registered but account is not active. Confirmation message will be

The activation link has been sent.

  1. User is registered and account is already active. Confirmation message will be

The account is already active. If you have forgotten your password, please click here.

We are having doubts about the second confirmation message. It tells too much about the fact that the account already exists. Are there best practices or security tips regarding these kinds of messages?

Or do you have any suggestions?

Edit 2017.03.17

We have implemented a new solution. No matter the output, we will display the following message:

If you are registered, you will soon receive an email.

However, the email sent will depend on the output:

  • If the account is not active, we will be sending the activation link.
  • If the account is already active, we will be sending an email saying that the account is already active and explaining the "password forgotten" procedure.

This solution seems to be the most appropriate in our situation. If you have any other suggestions, please submit.

Improve this question
6
  • The real question is if disguising the existence of user accounts improves security. It doesn't. User accounts are assumed to be public.
    – schroeder ♦
    Mar 16, 2017 at 15:05
  • @schroeder Not in all cases - I bet the users of Ashley Madison weren't counting on their accounts being public, for example... Email addresses are public knowledge, generally, but whether a given user has an account on a specific site isn't always.
    – Matthew
    Mar 16, 2017 at 15:08
  • 1
    @Matthew Ashley Madison did not use emails as the username .... For this very reason ...
    – schroeder ♦
    Mar 16, 2017 at 15:14
  • Unfortunately, we are using emails as usernames. No matter what, we will be telling that the account exists. The thing is to be less explicit, I think.
    – BS_C3
    Mar 16, 2017 at 15:22
  • Your 2017.03.17 edit looks like an answer, which would let you close this question.
    – Adam Katz
    Sep 13, 2017 at 14:39

1 Answer 1

Reset to default
0

Edit 2017.03.17

We have implemented a new solution. No matter the output, we will display the following message:

If you are registered, you will soon receive an email.

However, the email sent will depend on the output:

If the account is not active, we will be sending the activation link.
If the account is already active, we will be sending an email saying that the account is already active and explaining the "password forgotten" procedure.

This solution seems to be the most appropriate in our situation. If you have any other suggestions, please submit.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .