I'm working on a new site that uses asp.net identity to register users. I'm making use of email addresses as usernames and the email address has to be confirmed before the user can log in.
I've been working according to the spec and our organisational Password Management policy. The combination of the 2 would have me give various detailed messages to a user when performing account related actions e.g.:
- When selecting "Forgotten password" for a non existing username display the message: This username does not exist.
I've been thinking that the better practice would be not to confirm nor deny whether the email address exists. For this reason I want to show the success message: "Instructions on how to proceed was sent to the email address provided" even when the user provided does not exist.
Applying this principle to other account related actions is a bit tricky, though. For instance; according to the spec when selecting Resend confirmation email for an account that is already confirmed I should show the message: "This account is already activated". That right there shows any other anonymous user that the account exists. Now, if I show the success message, then the user might sit and wait for the email, which means that I should actually send him an email. Should this email then be the usual activation email, or one that states: "Your account is already activated. Please open the site and log in."
Another issue is when registering. If I show a generic "Invalid registration attempt" message when registering with an existing account, my service desk could be flooded with calls from angry users. (OK, probably not flooded, but after the first one the service desk discovers that the user contacted them due to a generic error message for a specific and identified issue, they will request me, or any developer, to amend the error message to show the user what the problem is) Once again, though, if I show the user a message stating that the account already exists, then then we're back where we started.
Also, when a user logs in 5 times incorrectly, I'm to lock out his account. If I tell him his account is locked out, this is yet another means by which an anonymous individual can confirm whether the username exists or not.
I've looked for some literature online with guidelines regarding these interactions, but have not found much.