14

You have a website that users log into, and you want to prevent user enumeration.

On the login page and the forgotten password page, this can be achieved by careful choice of user messages, but what about the new user registration page? You want to ensure that creating an account for an existing user is impossible, but this tells an attacker that the account already exists, allowing enumeration.

What mechanisms can be used to prevent user enumeration on new user registration?

12

Since the username is the public part, it isn't the end of the world if it can be enumerated, however if you really do want to avoid this, the easiest thing is to have them use e-mail address as the username. Then you simply say that you sent a link to the e-mail no matter if they have an account already or not.

4

An option is to use captcha. The the username can be verified after a submission and the captcha is updated if the username is already taken. This at least should slow down the process.

I think there are other options, but they are complex (for example have a exponential time to return the page after a submission for a duplication user) or could render the application unusable (block user for a an amount of time after X attempts).

If you're using emails as usernames, then the 2nd option is not that bad.

  • "and the captcha is updated if the username is already taken." - Now you can enumerate usernames by checking to see if the captcha is updated. – cytinus Dec 5 '18 at 17:09
1

User enumeration is not so evil. Username is public part, password is secret. For example, on this page we all can know that user James_pic exists on stackexchange. Googling or writing simple crawler can easily give attacker great number of usernames, helping to narrow attack, but other security measures still making attackers task very hard.

Idea is to have security policy (at least unwritten, in mind), separate public and secret things and focus efforts on securing what must be secret. If you want to use username as 'second part of secret', thats probably wrong way, better require two times longer passwords, or two factor authentication, because keeping usernames in secret is much harder.

If for some reason you need to keep usernames secret too (for example, you dont want anyone to know how many users registered) - then maybe better to assign username yourself (e.g. userNNNNN, or user-<10 random letters>) or use apprach with email or phone number as username.

  • The site in question is an eCommerce site, so there's no reason for one user to know about another. On one level, I suspect you're right (the question was prompted by a security audit, and I suspect the auditor was getting paid by the finding), but is there a general solution to the problem? – James_pic Oct 10 '14 at 12:45
  • 2
    For enterprise software, user enumeration can become more sensitive. It can provide some phishing targets to let you get access to the organization as a whole. – Zak Kus Oct 24 '14 at 0:15
-2

Another option is to use the same approach as login screen: Tell them theres something wrong, but not whats wrong.

Here is a example error message:

"A error occured with your registration. The cause of the error can be:
- The username is invalid or is already taken. Select Another username.
- The password is of a invalid length. Use a longer password.
- Both passwords do not match. Retype your passwords to ensure you entered them correctly.
- The email adress you entered is already registred or is invalid. Use a Another email adress.
- The captcha is invalid. Write the response for the captcha correctly.
- You have not agreed to the terms of service. Make sure you agree to the terms of service and check the applicable checkbox below.

Correct any errors in registration and try again. We do not disclose the reason why the registration failed for security reasons."

This can be negative to user experience because they dont know why their registration is rejected. But sometimes, user expericence has to be traded for security.

  • This one works well when there's no way for the user to know which field is wrong - so it works well when there's a username and an email, but less well when the user can verify all the fields but the username (for example if the password requirements are detailed on the page). Also, I've heard of sites requiring each user to have a unique password, and whilst that's not necessarily a good idea, it would work well with this. – James_pic Oct 14 '14 at 15:14
  • 4
    This doesn't prevent enumeration, it'll just annoy new users who don't know why their form was rejected. An attacker will quickly learn how to script the form submission to always be valid in every field except the username they wish to test for existence. – perfectionist Oct 6 '15 at 16:44
-3

You can add a massive list of public usernames to the database and do not let the users choose them and reply with a general error. In this way, an attacker can not distinguish between a valid an invalid user.

The disadvantage would be: 1- limiting the users to choose their deliberate username 2- Decrease the performance by adding a new query in the fake usernames

any idea?

  • This is a duplicate answer. Did you mean to ask a question at the end? – schroeder Jan 25 '16 at 4:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.