6

I am looking at an application redesign and one of our business team research says that we are not getting or losing customers because they are not able to login. While I don't really care about the stats, my goal is to see that the app is secure.

The current message is as written in the ancient world "Your username or password is invalid" and this is planned to change to "Your username is invalid". Note this is only to get the username and we have a tight flow for password recovery.

I understand the abuse cases on this change, however, I am always given references of Google, eBay, Facebook... and more, that they do allow user enumeration.

Need comments on how you guys are tackling this issue, strategies, design changes - anything that will help me.

7

As a pentester, I generally call out username enumeration as a very low or informational issue, but this can vary based on the application I'm looking at. Things that factor into how big an issue username enum really is:

  • Authentication lockout enforced at the IP level. If you can only try a couple passwords before getting locked out, password guessing becomes much less practical, even with a list of valid usernames. Most attackers aren't going to have access to enough IP addresses to bypass an IP address lockout.

  • Password policy. If you don't enforce strong passwords on your site, username enum can degrade an already poor password hygiene. Having a list of usernames is slightly less useful if they're all using decent passwords.

  • Is there any value for enumerating users outside of password guessing? Does the username reveal anything about the user? Would this help an attacker guess the name of an administrative account?

  • One last point to keep in mind - almost every site has username enumeration in the registration flow (you can't sign up for gmail with an existing email, and the site will tell you that). One mitigation for this is the use of captchas, but this is a risk that nearly every site has to live with to some extent.

In your example regarding error messages upon login, I'll always advocate for the safer 'Invalid username/password combo' message. However, I understand that fixing security flaws can be resource intensive, and I'd rather those resources be devoted to more significant problems. If you have the time and resources to fix it, by all means do so. If you have poor password hygiene as it is, maybe prioritize this a little higher than you would otherwise.

  • Good response and thought-provoking. We do have strict policies for the password, however as you can guess some customers will use the same passwords on all their sites. Risk-based approach and reading your comments i am now certain that i am on the right path on this and possibly having user enumeration is not a big risk for me. – Gautam P Feb 14 '19 at 2:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.