0

It's considered a best practice in security for login form to provide a vague error message

  • your username or password is wrong

rather than the more precise:

  • username does not exists
  • wrong password

the understandable justification is that while being less optimal in term of UX (the user may not see the issue is that they registered with their professional email and think the issue come from the password), it provides better security by not giving away information.

HOWEVER

most of websites implementing that will actually give away this information during the registration process by telling you the email is already existing.

So in that case isn't it security theater ? i.e an attacker try to register your account, and then he knows your username or password is wrong can only be wrong password and we haven't actually improved security ?

The way to mitigate that would be to not give away this information during the registration process, but when your registration form is only email + password, you can not really do that ? So in this case, is it still necessary to provide a vague error message at login ?

1 Answer 1

1

The way to mitigate that would be to not give away this information during the registration process, but when your registration form is only email + password, you can not really do that ?

If you're using the email address as the username then can easily avoid giving away this information during registration. You simply present the user with a message such as "An email has been sent to your address with further instructions", and then either sent them a account activation email (if the account isn't already registered), or a password recovery email if it is.

There could be several reasons why websites allow enumeration on registration but not login, such as:

  • The registration process having other protections (rate linting, CAPTCHA, etc) that they feel mitigate the risk.
  • Registration being a "noisier" activity, and thus being less likely to be targeted by an attacker.
  • They believe that the UX impact isn't worth it.
  • They didn't think about it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .