Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [registration]

Registration can refer to: (-) The act of making an identity on a service (like getting a Facebook account) (-) The process of getting credentials from a service (like using OpenID to login to Stack Exchange) (-) The protocol to get information from a system (like getting updates from a Forum you want to follow)

0
votes
1answer
45 views

Secure Register - Login Portal [closed]

Im trying to create a secure portal for parents to view their sons or daughters information. I would need to have a register page. Im having trouble with hashing and salting the password. Then I ...
2
votes
0answers
38 views

'Fake SSO & self registration' access to a web api

I was asked to design and implement a solution that I have some security concerns about. The customer has a web application into which users log in using their credentials. The customer wants to add ...
1
vote
0answers
47 views

What might an attacker do with email address as login name?

This might have been asked before, but I've looked for a few hours and can't find much. I would also like some opinions on what an attacker might do if he enters an email address on a site and it ...
2
votes
3answers
85 views

When a user tries to register with an unactivated email again, should I tell user that the emails has not been activated?

Suppose my site needs to register for a member account with email, and the email needs to be verified and activated. I forbid users to register with same email twice. When it does, should I remind the ...
4
votes
1answer
75 views

How is this registration setup vulnerable?

I'm developing a mobile app for iOS and Android that has, due to specs that are given by management, some security flaws. However, I can't quite explain in concrete business speak why the specs are ...
1
vote
2answers
127 views

How can I protect the signup form in my website? Is special spam prevention needed?

I'm struggling to write a secure sign-up form for my website. (My site is some kind of an image gallery. I have knowledge in html, javascript, msql and php) I know there is a tactic to secure login ...
8
votes
4answers
907 views

Prevent against OTP abuse in app sign up flow

This may sound like an open ended question, but I would like to take my chances and understand if there is any way the rest of the community is handling this issue. Let's say there is an app that ...
6
votes
1answer
194 views

Are there any proposals for email verification without a confirmation email?

Being able to confirm your email without waiting for a verification email would be a major improvement to many registration processes. In theory this could be done using a technique based on OAuth, ...
0
votes
2answers
130 views

Is the following set of steps, secure enough, during register and login on my webapp? [closed]

Register: Both text boxes of the user inputted password are compared, if they match: Add the user's email to the [users] table in the database, to have a user ID to later record everything against. ...
5
votes
3answers
841 views

Receiving lots of spam after registering a new domain on GoDaddy

A couple of days ago I have registered a new domain on GoDaddy without WHOIS privacy option. The next day after registration I have started receiving spam in my mailbox as well as on my phone. The ...
0
votes
2answers
100 views

Activating a user on a website — why include anything other than an activation code?

Quite often in order to active my account on a website I'll receive an email with this: https://web_site.com/access?uid=1234&secret=456789&login=0123456789&mid=aabbcccdd Why user id, ...
13
votes
4answers
4k views

Is this passwordless system secure?

A person has a form that asks for a name and password. The password is sent to the server where a hash is created from hashing the name and password. This hash is converted into a number using the ...
1
vote
1answer
132 views

Is username and password needed to register and authenticate user in zero knowledge guillou quisquater?

I want to make guillou quisquater authentication for a website with Laravel (PHP). The authentication is between server and client(user). In the references i've read (here and here) the registration ...
1
vote
1answer
76 views

Spoofing domain registration date info

Is it possible to spoof or change backwards Domain Registration Date that can be looked up in online whois tools and databases?
2
votes
2answers
151 views

Facebook mobile app is often asking about my phone number for registeration, field is entered already. Where does facebook take this phone numbers?

Facebook mobile app is often asking about my phone number for registration. It shows a screen saying that "Keep your account secure and keep using it securely" and "We are trying to help you to secure ...
2
votes
2answers
92 views

Skill testing question in registration page

I've seen some registration pages that have a "skill testing question" in addition to having a captcha. These skill testing questions are usually easy trivia, such as "what is 2 + 2" or "who invented ...
0
votes
0answers
81 views

Automatic login after registration

After a user has registered a new account I want the new user of my site to be logged in automatically, i.e. an automatic login after registration. The registration is a JavaScript application. When ...
3
votes
2answers
75 views

Enrolling Users Best Practices

I am working on a site where the administrators enroll the users. Currently, after the user is created, they are assigned a password and sent an email with a link that has them confirm their email. ...
10
votes
6answers
2k views

Is it safe to authenticate user by email confirmation link?

When a user registers on a website, he has to confirm e-mail to activate account. When clicking confirmation link, the user is identified by one-time hash to activate account. Is it safe to ...
4
votes
2answers
125 views

Is there any security threat due to returning password on form submitting failure (for example on a signup page)?

Let say that we have a registration page on a website, why shouldn't we return passwords like username, names or any other information on form submitting failure? For example: User goes to example....
1
vote
1answer
330 views

What are the disadvantages of logging someone in on register?

So presuming a username/password authentication system (not an SSO) if you register a new user, what's the disadvantage of logging them in before verifying their account by email? Let's presume that ...
0
votes
1answer
471 views

PHP registration script, how to check if request is coming from a credible source

I've got a php registration script, that just takes all the data as a post request. I've got another page which sends that data to the script using jQuery ajax. How can i be sure, that the request ...
8
votes
3answers
671 views

How To Stop A Mobile Verification Attack

I am thinking of using mobile phone number verification for the sign up step in my web application but how do I prevent a hacker or a malicious user from sending mobile verification requests to an ...
1
vote
1answer
91 views

Risks and strategies to implement anonymous storage of Google Cloud Messaging tokens?

I'm writing a mobile app that aggregates weather data and generates a push notification when certain criteria are met. The user has the option to change some of the variables (e.g. if the current ...
0
votes
2answers
412 views

Pros and cons of password policy filtering common weak passwords? [duplicate]

We all know the basics "password rules" when a user register on a website, such as: more than 8 characters, must contain an upper case letter, must contain numbers and so on Why don't websites ...
5
votes
2answers
4k views

How can we protect signup APIs from brute force registration?

This is a general question but its prompted by a fairly open API I have for a file storage service that needs to have its front door better locked down. We have an API like POST '/signup' that just ...
1
vote
1answer
88 views

Why is the password field blanked in the registration form if the validation fail? [duplicate]

Is it really a problem if you send back the password when the validation fail on a registration form? I understand that the html that is sent back could be cached on the computer of the person ...
11
votes
3answers
910 views

How can you prevent email addresses from being harvested from a registration form?

When you go to a website's login form and enter the wrong credentials, the website can give you one of three error messages: Your email is wrong Your password is wrong Your email or password is wrong ...
4
votes
1answer
186 views

Asking for Password After Email Validation?

I do not want to discuss the pros and cons of email validation, but want to know if there are any potential downsides (security and otherwise) to a user entering his password only after he has already ...
4
votes
1answer
606 views

best practices for handling self-registration?

For example, with a bank's credit card activation/registration, that user is required to authenticate with a unique code that was mailed to their address. If they don't get that mailout-with-the-code, ...
15
votes
3answers
5k views

Forgot password and revealing whether account exists

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets; Notify the user whether or not the ...
2
votes
3answers
15k views

Advantages to alphanumeric-only usernames?

Let's say we are setting up some registration form for some website. I know that if input fields aren't sanitized then SQL injection can happen. But let's say all fields are sanitized correctly. Is ...
8
votes
1answer
1k views

Prevent phishing attacks through abuse of Apple iOS URL scheme

I am building an Apple iOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is ...
6
votes
1answer
262 views

Re-display password in registration form good or bad?

When a user tries to register and the data he submits are not right such as bad email, or weak password, we would display the registration page again to him with the data he just submitted along with ...