Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [registration]

Registration can refer to: (-) The act of making an identity on a service (like getting a Facebook account) (-) The process of getting credentials from a service (like using OpenID to login to Stack Exchange) (-) The protocol to get information from a system (like getting updates from a Forum you want to follow)

Filter by
Sorted by
Tagged with
0 votes
1 answer
66 views

Is it possible to avoid exposing the fact that an e-mail address is used by a web application (API) while still ensuring a decent UX?

One of the raised issues for a Web API is that for an e-mail based authentication (e-mail and password) the Register user method returns something like "the registration e-mail has been sent"...
user avatar
  • 2,183
5 votes
4 answers
2k views

Do MFA QR registration codes/keys expire?

MFA recovery codes last forever until used. The TOTP codes expire as per the clock (e.g. 30 seconds). Does the initial QR code to register a MFA device last forever until disabled by a MFA reset? I'm ...
user avatar
  • 123k
1 vote
1 answer
167 views

What are the best practices to create a safe and performant user registration and validation with Nodejs and Postgres? [closed]

I've been asked to write an app with registration and login systems. In essence, I've already wrote the first version of their app using PHP, some javascript/jquery and storing data in MySQL. It ...
user avatar
  • 111
58 votes
8 answers
10k views

Should I log users in if they enter valid login info in registration form?

Recently, we've had users complain that they forget that they have an account, try registering, and get error message that the user with such email already exists. There is a proposal to just log them ...
user avatar
0 votes
1 answer
56 views

Error message when logging in with valid credentials while registration not complete

I have a registration login process which includes a one-time activation link sent via email when the user registers. When the user clicks the link the account get's activated. Now what error message ...
user avatar
0 votes
3 answers
156 views

Let user send an email to register to prevent outgoing mail abuse

Problem Consider a standard sign-up form (user enters an email address, we send a confirmation link). Even limiting that form per IP (or even globally per hour), I'm concerned about abuse: Our real-...
user avatar
18 votes
3 answers
6k views

Is cell phone number based verification secure?

Websites often send a code to a cell phone number for verification. Is this secure? If it is not secure, are there any better alternatives?
user avatar
0 votes
1 answer
551 views

Why can I still receive email at my old domain after someone else bought it?

My domain expired years ago and was registered by another party. I have already read Can someone read my E-Mail if I lose ownership of my domain? and see that the answer is yes. Now if someone buys ...
user avatar
10 votes
2 answers
2k views

When should user invite links (tokens) expire?

We have a system in which external users can be invited to our identity management system. The users are not employees of our company, but of our customers. The administrators of the customer do not ...
user avatar
-1 votes
2 answers
152 views

Recommending diceware upon user registration

The Diceware method of password generation is simple, secure and easy to use When registering an account on a website Why do websites not suggest to their users to use the diceware method? Why do ...
user avatar
0 votes
3 answers
142 views

Sending static registration links via email

In our mobile application, users need to register first before they can use it. After successful registration, they an now login and use features of the app. Now we will have a feature in our ...
user avatar
3 votes
1 answer
181 views

A workaround for external website's HTTP registration page

There is a website which I want to register for but it is a internship/job-seeking website and thus on registration some VERY sensitive data is required. When registering Firefox alerted me that the ...
user avatar
1 vote
2 answers
660 views

How can it be that I can't register on a website while my VPN is on

I've had problems with making a account on a website (https://etsy.com) I tried different browsers, disabeling all my plugins with no succes. I use a VPN service that automaticly turn on when I start ...
user avatar
  • 11
1 vote
2 answers
197 views

Do registration codes need expiry?

I work on an application where users are sent a unique registration code in the post. They use this, along with other personal information known to the user, to confirm the identity of the user upon ...
user avatar
  • 11
8 votes
1 answer
179 views

What is this user-friendly device registration process called?

Logging in with a username/password can be annoying on non-keyboard devices (game consoles, Rokus, etc). Many media apps on these devices improve on this process by letting me activate my device on my ...
user avatar
0 votes
1 answer
180 views

How effective is mobile phone verification in stopping fake user registration?

Or in other words, how much work and money does someone has to do/have to have many SIM cards with many numbers, each loaded in a mobile phone.
user avatar
0 votes
1 answer
88 views

Secure Register - Login Portal [closed]

Im trying to create a secure portal for parents to view their sons or daughters information. I would need to have a register page. Im having trouble with hashing and salting the password. Then I ...
user avatar
2 votes
0 answers
142 views

'Fake SSO & self registration' access to a web api

I was asked to design and implement a solution that I have some security concerns about. The customer has a web application into which users log in using their credentials. The customer wants to add ...
user avatar
  • 121
1 vote
0 answers
108 views

What might an attacker do with email address as login name?

This might have been asked before, but I've looked for a few hours and can't find much. I would also like some opinions on what an attacker might do if he enters an email address on a site and it ...
user avatar
  • 11
2 votes
3 answers
182 views

When a user tries to register with an unactivated email again, should I tell user that the emails has not been activated?

Suppose my site needs to register for a member account with email, and the email needs to be verified and activated. I forbid users to register with same email twice. When it does, should I remind the ...
user avatar
  • 525
4 votes
1 answer
135 views

How is this registration setup vulnerable?

I'm developing a mobile app for iOS and Android that has, due to specs that are given by management, some security flaws. However, I can't quite explain in concrete business speak why the specs are ...
user avatar
1 vote
2 answers
436 views

How can I protect the signup form in my website? Is special spam prevention needed?

I'm struggling to write a secure sign-up form for my website. (My site is some kind of an image gallery. I have knowledge in html, javascript, msql and php) I know there is a tactic to secure login ...
user avatar
  • 13
16 votes
4 answers
5k views

Prevent against OTP abuse in app sign up flow

This may sound like an open ended question, but I would like to take my chances and understand if there is any way the rest of the community is handling this issue. Let's say there is an app that ...
user avatar
  • 1,472
5 votes
1 answer
343 views

Are there any proposals for email verification without a confirmation email?

Being able to confirm your email without waiting for a verification email would be a major improvement to many registration processes. In theory this could be done using a technique based on OAuth, ...
user avatar
  • 32.6k
0 votes
2 answers
170 views

Is the following set of steps, secure enough, during register and login on my webapp? [closed]

Register: Both text boxes of the user inputted password are compared, if they match: Add the user's email to the [users] table in the database, to have a user ID to later record everything against. ...
user avatar
5 votes
3 answers
2k views

Receiving lots of spam after registering a new domain on GoDaddy

A couple of days ago I have registered a new domain on GoDaddy without WHOIS privacy option. The next day after registration I have started receiving spam in my mailbox as well as on my phone. The ...
user avatar
0 votes
2 answers
170 views

Activating a user on a website -- why include anything other than an activation code?

Quite often in order to active my account on a website I'll receive an email with this: https://web_site.com/access?uid=1234&secret=456789&login=0123456789&mid=aabbcccdd Why user id, ...
user avatar
  • 2,147
14 votes
4 answers
4k views

Is this passwordless system secure?

A person has a form that asks for a name and password. The password is sent to the server where a hash is created from hashing the name and password. This hash is converted into a number using the ...
user avatar
  • 159
1 vote
1 answer
204 views

Is username and password needed to register and authenticate user in zero knowledge guillou quisquater?

I want to make guillou quisquater authentication for a website with Laravel (PHP). The authentication is between server and client(user). In the references i've read (here and here) the registration ...
user avatar
  • 13
1 vote
2 answers
248 views

Spoofing domain registration date info

Is it possible to spoof or change backwards Domain Registration Date that can be looked up in online whois tools and databases?
user avatar
  • 353
2 votes
2 answers
212 views

Facebook mobile app is often asking about my phone number for registeration, field is entered already. Where does facebook take this phone numbers?

Facebook mobile app is often asking about my phone number for registration. It shows a screen saying that "Keep your account secure and keep using it securely" and "We are trying to help you to secure ...
user avatar
2 votes
2 answers
144 views

Skill testing question in registration page

I've seen some registration pages that have a "skill testing question" in addition to having a captcha. These skill testing questions are usually easy trivia, such as "what is 2 + 2" or "who invented ...
user avatar
  • 10k
0 votes
0 answers
175 views

Automatic login after registration

After a user has registered a new account I want the new user of my site to be logged in automatically, i.e. an automatic login after registration. The registration is a JavaScript application. When ...
user avatar
  • 701
2 votes
2 answers
161 views

Enrolling Users Best Practices

I am working on a site where the administrators enroll the users. Currently, after the user is created, they are assigned a password and sent an email with a link that has them confirm their email. ...
user avatar
13 votes
6 answers
4k views

Is it safe to authenticate user by email confirmation link?

When a user registers on a website, he has to confirm e-mail to activate account. When clicking confirmation link, the user is identified by one-time hash to activate account. Is it safe to ...
user avatar
  • 241
4 votes
2 answers
241 views

Is there any security threat due to returning password on form submitting failure (for example on a signup page)?

Let say that we have a registration page on a website, why shouldn't we return passwords like username, names or any other information on form submitting failure? For example: User goes to example....
user avatar
1 vote
1 answer
538 views

What are the disadvantages of logging someone in on register?

So presuming a username/password authentication system (not an SSO) if you register a new user, what's the disadvantage of logging them in before verifying their account by email? Let's presume that ...
user avatar
0 votes
1 answer
829 views

PHP registration script, how to check if request is coming from a credible source

I've got a php registration script, that just takes all the data as a post request. I've got another page which sends that data to the script using jQuery ajax. How can i be sure, that the request ...
user avatar
  • 101
11 votes
3 answers
2k views

How To Stop A Mobile Verification Attack

I am thinking of using mobile phone number verification for the sign up step in my web application but how do I prevent a hacker or a malicious user from sending mobile verification requests to an ...
user avatar
  • 741
1 vote
1 answer
134 views

Risks and strategies to implement anonymous storage of Google Cloud Messaging tokens?

I'm writing a mobile app that aggregates weather data and generates a push notification when certain criteria are met. The user has the option to change some of the variables (e.g. if the current ...
user avatar
0 votes
2 answers
563 views

Pros and cons of password policy filtering common weak passwords? [duplicate]

We all know the basics "password rules" when a user register on a website, such as: more than 8 characters, must contain an upper case letter, must contain numbers and so on Why don't websites ...
user avatar
  • 193
6 votes
2 answers
7k views

How can we protect signup APIs from brute force registration?

This is a general question but its prompted by a fairly open API I have for a file storage service that needs to have its front door better locked down. We have an API like POST '/signup' that just ...
user avatar
  • 181
1 vote
1 answer
125 views

Why is the password field blanked in the registration form if the validation fail? [duplicate]

Is it really a problem if you send back the password when the validation fail on a registration form? I understand that the html that is sent back could be cached on the computer of the person ...
user avatar
  • 6,891
15 votes
3 answers
2k views

How can you prevent email addresses from being harvested from a registration form?

When you go to a website's login form and enter the wrong credentials, the website can give you one of three error messages: Your email is wrong Your password is wrong Your email or password is wrong ...
user avatar
4 votes
1 answer
329 views

Asking for Password After Email Validation?

I do not want to discuss the pros and cons of email validation, but want to know if there are any potential downsides (security and otherwise) to a user entering his password only after he has already ...
user avatar
  • 41
5 votes
1 answer
972 views

best practices for handling self-registration?

For example, with a bank's credit card activation/registration, that user is required to authenticate with a unique code that was mailed to their address. If they don't get that mailout-with-the-code, ...
user avatar
  • 51
26 votes
3 answers
10k views

Forgot password and revealing whether account exists

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets; Notify the user whether or not the ...
user avatar
3 votes
3 answers
17k views

Advantages to alphanumeric-only usernames?

Let's say we are setting up some registration form for some website. I know that if input fields aren't sanitized then SQL injection can happen. But let's say all fields are sanitized correctly. Is ...
user avatar
  • 133
9 votes
1 answer
1k views

Prevent phishing attacks through abuse of Apple iOS URL scheme

I am building an Apple iOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is ...
user avatar
7 votes
1 answer
326 views

Re-display password in registration form good or bad?

When a user tries to register and the data he submits are not right such as bad email, or weak password, we would display the registration page again to him with the data he just submitted along with ...
user avatar
  • 739