Questions tagged [registration]

Registration can refer to: (-) The act of making an identity on a service (like getting a Facebook account) (-) The process of getting credentials from a service (like using OpenID to login to Stack Exchange) (-) The protocol to get information from a system (like getting updates from a Forum you want to follow)

Filter by
Sorted by
Tagged with
20 votes
4 answers

Prevent against OTP abuse in app sign up flow

This may sound like an open ended question, but I would like to take my chances and understand if there is any way the rest of the community is handling this issue. Let's say there is an app that ...
qre0ct's user avatar
  • 1,522
31 votes
3 answers

Forgot password and revealing whether account exists

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets; Notify the user whether or not the ...
Stafford Williams's user avatar
7 votes
2 answers

How can we protect signup APIs from brute force registration?

This is a general question but its prompted by a fairly open API I have for a file storage service that needs to have its front door better locked down. We have an API like POST '/signup' that just ...
user's user avatar
  • 191
7 votes
1 answer

Re-display password in registration form good or bad?

When a user tries to register and the data he submits are not right such as bad email, or weak password, we would display the registration page again to him with the data he just submitted along with ...'s user avatar
  • 749
18 votes
3 answers

Is cell phone number based verification secure?

Websites often send a code to a cell phone number for verification. Is this secure? If it is not secure, are there any better alternatives?
Lone Learner's user avatar
13 votes
6 answers

Is it safe to authenticate user by email confirmation link?

When a user registers on a website, he has to confirm e-mail to activate account. When clicking confirmation link, the user is identified by one-time hash to activate account. Is it safe to ...
PeterM's user avatar
  • 241
6 votes
4 answers

Do MFA QR registration codes/keys expire?

MFA recovery codes last forever until used. The TOTP codes expire as per the clock (e.g. 30 seconds). Does the initial QR code to register a MFA device last forever until disabled by a MFA reset? I'm ...
schroeder's user avatar
  • 128k
1 vote
1 answer

How effective is mobile phone verification in stopping fake user registration?

Or in other words, how much work and money does someone has to do/have to have many SIM cards with many numbers, each loaded in a mobile phone.
warnerque's user avatar