13

Being on the company security email list, I get emails with some regularity complaining about email discovery on various forms on my employers website. The reporters are complaining about things like our login form returning a specific message like "You password is incorrect." rather than "The email/password provided are incorrect." This lets possible attackers know that a certain email address is in use for an account.

I understand the issue here, and it's easy to change the messaging for a login or account recovery form. However, what can I do about a signup form. We only want one account for any given email address. I've looked at some other popular online services and their signup forms specifically tell you that the email address is in use.

Is there just no way around this? If that's the case, should I really pay any heed to the people complaining about email discovery on the login form?

Improve this question

2 Answers 2

Reset to default
17

This can be solved by implementing an out of band message.

To solve this issue I would have a form which can be used for two purposes:

  1. Account recovery.
  2. New user sign up.

The single field on this form is Email address. Of course you can use different text depending on whether the user wanted to recover their account or sign up, but the way it works will be the same.

Once the user has entered their email address and clicked Next, the same response will be shown for any address entered. Something similar to Thank you, please check your email account for the provided address.

The "out of band" message sent their email address will either say Please follow the link to recover your account or Please follow the link to sign up to our service and will contain the appropriate links which will include a time-limited token to allow the user to recover their account or sign up as necessary. The only thing that determines the text of this message is whether an account exists for their email address within the system, it does not matter if the user followed the account recovery or new user sign up links. As they should be the only user that can read their email, this should prevent username enumeration. The token will be associated to the provided email which will stop the user then attempting to sign up using a different address, or to reset the password of any other account. This also has the effect of validating the email account for new sign ups.

Improve this answer
9
  • 1
    I like this. I've been staring at the problem too long, I never thought of tying it into post signup email validation.
    – Endophage
    Commented Dec 29, 2013 at 4:05
  • Need any further help with this? If so I'll update my answer.
    – SilverlightFox
    Commented Jan 6, 2014 at 10:55
  • 2
    @Gray: It very much depends on the system. Many systems such as web mail and social networking have user enumeration built into the design - it is not an issue if you find out a certain user has an account or not. With other systems you may have a massive list of email accounts and as the attacker you may wish to whittle down the list to only include the valid accounts ready for your brute force attack. For me, I don't think emailing the user hampers the UI at all - as said, this will also validate the email making sure they have a valid one for password reset in future.
    – SilverlightFox
    Commented Aug 19, 2014 at 13:33
  • 2
    @Gray: Also, if user enumeration is possible then the brute force attack could be soft enough as to not lock out particular users by only trying a handful of common passwords against each account. As more than one account is targeted the attacker has the advantage of low risk and the high chance of a hit. Furthermore, they could time their attack right so that by the time the first password has been tried on the last account any record of the failed login on the first account has expired. Another target for user enumeration is phishing. If they know an account exists they can target the email.
    – SilverlightFox
    Commented Aug 19, 2014 at 14:39
  • 1
    @Gray If you have a botnet, you can rapidly get more than 1000 email addresses. Even if you ban by IP, botnets control 100,000s if machines. I think you're also considering email addresses as being highly unique and they're not. Take a dictionary of first and last names, iterate over the permutations of those concatenated, I guarantee you get a good number of hits in just about every online service. That said, I tend to agree with you that I consider email addresses public information. However I don't consider my memberships public information.
    – Endophage
    Commented Aug 19, 2014 at 16:43
6

I think your best bet to prevent email enumeration in a situation like this is to add a CAPTCHA on your registration form. In order for an email enumeration attack to work an attacker must automate the submission of a very large number of emails to see which ones have accounts.

By adding a CAPTCHA you make it very difficult to effectively automate this type of attack and you can still give informative messages during registration.

Improve this answer
2
  • 1
    We've discussed CAPTCHAs. I'm for them, but there is a consideration from other stakeholders that they create a barrier to entry, even if only shown after some number of failed attempts. +1 for a very valid answer though.
    – Endophage
    Commented Dec 29, 2013 at 4:04
  • 1
    If it's a targeted attack CAPTCHA won't help, if the sensible information is "Is this email registered to this website" you only need to test one email. I can see this as a sensible information for dating application, political website, health-related application, etc.
    – luxcem
    Commented Dec 5, 2018 at 14:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .