Linked Questions

5
votes
1answer
180 views

Why do login screens hide the password input field until the username is provided? [duplicate]

I am noticing a trend in web development where login screens are no longer showing both the username and the password input fields simultaneously. Instead, you are required to type in your username ...
32
votes
5answers
9k views

Is having the username and password fields on different pages more secure?

An online bank I use requires inputting your username, navigating to a second page and then entering the password to login. What actual security advantage does this provide, if any?
14
votes
4answers
10k views

User name enumeration?

From what I understand it is bad security practice to display informative failed login messages like: The email you entered does not exist Instead of Incorrect email/password combination ...
14
votes
3answers
2k views

Are combined sign in / up pages dangerous, and how to improve them?

I'd like to code a combined sign in/up page like the one in the picture below. My colleague said this will allow spammers/hackers to see what email addresses are registered with our system and this ...
12
votes
3answers
1k views

Is it secure to have an “email no longer available” feature on your registration form?

I was just implementing a new feature on the registration form of my site that checks if an email address is still available to register an account with. I am wondering if it is secure to show a user ...
12
votes
4answers
6k views

Should email verification be followed by password-based login? Why?

[This is a duplicate, considered off-topic at https://stackoverflow.com/questions/26564992/should-email-verification-be-followed-by-password-based-login-why] A typical account creation process seems ...
11
votes
2answers
3k views

How to prevent email discovery in forms?

Being on the company security email list, I get emails with some regularity complaining about email discovery on various forms on my employers website. The reporters are complaining about things like ...
8
votes
4answers
3k views

Best practice for forgot password form, ok to leak that a given e-mail is invalid

On our forgot password reset form, is it ok to leak that a given e-mail address entered is invalid? Or should we always just return success and check your e-mail, even if the e-mail is not valid. I ...
3
votes
3answers
747 views

Is it safe to generate a password for a user during sign up in a web application?

I'm working on updating a web application. It currently creates a password for a user during sign up. Is asking the user to create the password themselves safer than relying on a generated password?
3
votes
2answers
539 views

Best practice for identity management methods with regards to confirming user existence

I'm working on a new site that uses asp.net identity to register users. I'm making use of email addresses as usernames and the email address has to be confirmed before the user can log in. I've been ...
2
votes
2answers
137 views

Why do login systems tell users an email address is not in the system? [duplicate]

Am I right assuming that by telling an attacker an email is or is not in the system the login is in fact weakened? Meaning if the attacker knows the email is correct he/she in fact already has 50% of ...