Questions tagged [registration]
Registration can refer to: (-) The act of making an identity on a service (like getting a Facebook account) (-) The process of getting credentials from a service (like using OpenID to login to Stack Exchange) (-) The protocol to get information from a system (like getting updates from a Forum you want to follow)
54
questions
22
votes
3
answers
5k
views
Is there a problem with having a combined login/register screen?
I am designing a new login/register process for a system and want to combine the 2 initial pages for register and login.
This would be one page where the user would enter their email and press '...
- 221
0
votes
1
answer
142
views
Will sky fall if I don't verify `AuthenticatorAttestationResponse`?
Through reading the WebAuthn spec and related MDN docs, I understand that unlike "certificate signing requests", FIDO/Passkey can have various different attestation formats and verification ...
- 374
2
votes
2
answers
339
views
Is a + on an email address a security vulnerability for a registration process?
Is + in email addresses a security vulnerability for authentication algorithms? How can it be used in a malicious way? Should we forbid emails with + signs during registration?
For example we have 2 ...
- 111
2
votes
3
answers
212
views
Is there a reason we don't first validate the email address before continuing with the registration?
Many websites and/or web apps require you to validate the e-mail address after registration.
Why don't we first validate the email address and then continue with the registration? Is there something ...
- 123
0
votes
1
answer
238
views
Is it possible to avoid exposing the fact that an e-mail address is used by a web application (API) while still ensuring a decent UX?
One of the raised issues for a Web API is that for an e-mail based authentication (e-mail and password) the Register user method returns something like "the registration e-mail has been sent"...
- 2,193
6
votes
4
answers
4k
views
Do MFA QR registration codes/keys expire?
MFA recovery codes last forever until used. The TOTP codes expire as per the clock (e.g. 30 seconds).
Does the initial QR code to register a MFA device last forever until disabled by a MFA reset?
I'm ...
- 132k
1
vote
1
answer
381
views
What are the best practices to create a safe and performant user registration and validation with Nodejs and Postgres? [closed]
I've been asked to write an app with registration and login systems. In essence, I've already wrote the first version of their app using PHP, some javascript/jquery and storing data in MySQL. It ...
- 111
58
votes
8
answers
11k
views
Should I log users in if they enter valid login info in registration form?
Recently, we've had users complain that they forget that they have an account, try registering, and get error message that the user with such email already exists. There is a proposal to just log them ...
0
votes
1
answer
111
views
Error message when logging in with valid credentials while registration not complete
I have a registration login process which includes a one-time activation link sent via email when the user registers. When the user clicks the link the account get's activated.
Now what error message ...
- 101
0
votes
3
answers
214
views
Let user send an email to register to prevent outgoing mail abuse
Problem
Consider a standard sign-up form (user enters an email address, we send a confirmation link).
Even limiting that form per IP (or even globally per hour), I'm concerned about abuse:
Our real-...
- 3
18
votes
3
answers
6k
views
Is cell phone number based verification secure?
Websites often send a code to a cell phone number for verification. Is this secure? If it is not secure, are there any better alternatives?
- 968
0
votes
1
answer
2k
views
Why can I still receive email at my old domain after someone else bought it?
My domain expired years ago and was registered by another party.
I have already read Can someone read my E-Mail if I lose ownership of my domain? and see that the answer is yes.
Now if someone buys ...
- 3
12
votes
2
answers
4k
views
When should user invite links (tokens) expire?
We have a system in which external users can be invited to our identity management system.
The users are not employees of our company, but of our customers. The administrators of the
customer do not ...
-1
votes
2
answers
202
views
Recommending diceware upon user registration
The Diceware method of password generation is simple, secure and easy to use
When registering an account on a website
Why do websites not suggest to their users to use the diceware method?
Why do ...
- 11
0
votes
3
answers
237
views
Sending static registration links via email
In our mobile application, users need to register first before they can use it. After successful registration, they an now login and use features of the app. Now we will have a feature in our ...
3
votes
1
answer
234
views
A workaround for external website's HTTP registration page
There is a website which I want to register for but it is a internship/job-seeking website and thus on registration some VERY sensitive data is required.
When registering Firefox alerted me that the ...
- 133
1
vote
2
answers
1k
views
How can it be that I can't register on a website while my VPN is on
I've had problems with making a account on a website (https://etsy.com)
I tried different browsers, disabeling all my plugins with no succes.
I use a VPN service that automaticly turn on when I start ...
- 11
2
votes
2
answers
397
views
Do registration codes need expiry?
I work on an application where users are sent a unique registration code in the post. They use this, along with other personal information known to the user, to confirm the identity of the user upon ...
- 21
8
votes
1
answer
227
views
What is this user-friendly device registration process called?
Logging in with a username/password can be annoying on non-keyboard devices (game consoles, Rokus, etc). Many media apps on these devices improve on this process by letting me activate my device on my ...
- 183
1
vote
1
answer
333
views
How effective is mobile phone verification in stopping fake user registration?
Or in other words, how much work and money does someone has to do/have to have many SIM cards with many numbers, each loaded in a mobile phone.
- 13
0
votes
1
answer
118
views
Secure Register - Login Portal [closed]
Im trying to create a secure portal for parents to view their sons or daughters information.
I would need to have a register page. Im having trouble with hashing and salting the password.
Then I ...
1
vote
0
answers
223
views
'Fake SSO & self registration' access to a web api
I was asked to design and implement a solution that I have some security concerns about.
The customer has a web application into which users log in using their credentials.
The customer wants to add ...
- 111
1
vote
0
answers
149
views
What might an attacker do with email address as login name?
This might have been asked before, but I've looked for a few hours and can't find much.
I would also like some opinions on what an attacker might do if he enters an email address on a site and it ...
- 11
2
votes
3
answers
286
views
When a user tries to register with an unactivated email again, should I tell user that the emails has not been activated?
Suppose my site needs to register for a member account with email, and the email needs to be verified and activated. I forbid users to register with same email twice. When it does, should I remind the ...
- 535
4
votes
1
answer
202
views
How is this registration setup vulnerable?
I'm developing a mobile app for iOS and Android that has, due to specs that are given by management, some security flaws. However, I can't quite explain in concrete business speak why the specs are ...
- 141
1
vote
3
answers
779
views
How can I protect the signup form in my website? Is special spam prevention needed?
I'm struggling to write a secure sign-up form for my website. (My site is some kind of an image gallery. I have knowledge in html, javascript, msql and php)
I know there is a tactic to secure login ...
- 13
20
votes
4
answers
8k
views
Prevent against OTP abuse in app sign up flow
This may sound like an open ended question, but I would like to take my chances and understand if there is any way the rest of the community is handling this issue.
Let's say there is an app that ...
- 1,522
5
votes
1
answer
469
views
Are there any proposals for email verification without a confirmation email?
Being able to confirm your email without waiting for a verification email would be a major improvement to many registration processes. In theory this could be done using a technique based on OAuth, ...
- 34.6k
0
votes
2
answers
196
views
Is the following set of steps, secure enough, during register and login on my webapp? [closed]
Register:
Both text boxes of the user inputted password are compared, if they match:
Add the user's email to the [users] table in the database, to have a user ID to later record everything against.
...
- 180
6
votes
3
answers
2k
views
Receiving lots of spam after registering a new domain on GoDaddy
A couple of days ago I have registered a new domain on GoDaddy without WHOIS privacy option. The next day after registration I have started receiving spam in my mailbox as well as on my phone. The ...
- 203
0
votes
2
answers
214
views
Activating a user on a website -- why include anything other than an activation code?
Quite often in order to active my account on a website I'll receive an email with this:
https://web_site.com/access?uid=1234&secret=456789&login=0123456789&mid=aabbcccdd
Why user id, ...
- 2,257
14
votes
4
answers
4k
views
Is this passwordless system secure?
A person has a form that asks for a name and password. The password is sent to the server where a hash is created from hashing the name and password. This hash is converted into a number using the ...
- 159
1
vote
1
answer
236
views
Is username and password needed to register and authenticate user in zero knowledge guillou quisquater?
I want to make guillou quisquater authentication for a website with Laravel (PHP). The authentication is between server and client(user). In the references i've read (here and here) the registration ...
- 13
1
vote
2
answers
349
views
Spoofing domain registration date info
Is it possible to spoof or change backwards Domain Registration Date that can be looked up in online whois tools and databases?
- 383
2
votes
2
answers
277
views
Facebook mobile app is often asking about my phone number for registeration, field is entered already. Where does facebook take this phone numbers?
Facebook mobile app is often asking about my phone number for registration. It shows a screen saying that "Keep your account secure and keep using it securely" and "We are trying to help you to secure ...
- 129
2
votes
2
answers
183
views
Skill testing question in registration page
I've seen some registration pages that have a "skill testing question" in addition to having a captcha. These skill testing questions are usually easy trivia, such as "what is 2 + 2" or "who invented ...
- 10.2k
0
votes
0
answers
271
views
Automatic login after registration
After a user has registered a new account I want the new user of my site to be logged in automatically, i.e. an automatic login after registration. The registration is a JavaScript application. When ...
- 691
2
votes
2
answers
247
views
Enrolling Users Best Practices
I am working on a site where the administrators enroll the users. Currently, after the user is created, they are assigned a password and sent an email with a link that has them confirm their email. ...
- 21
13
votes
6
answers
5k
views
Is it safe to authenticate user by email confirmation link?
When a user registers on a website, he has to confirm e-mail to activate account.
When clicking confirmation link, the user is identified by one-time hash to activate account.
Is it safe to ...
- 241
4
votes
2
answers
323
views
Is there any security threat due to returning password on form submitting failure (for example on a signup page)?
Let say that we have a registration page on a website, why shouldn't we return passwords like username, names or any other information on form submitting failure?
For example:
User goes to example....
- 867
2
votes
1
answer
742
views
What are the disadvantages of logging someone in on register?
So presuming a username/password authentication system (not an SSO) if you register a new user, what's the disadvantage of logging them in before verifying their account by email?
Let's presume that ...
- 322
0
votes
1
answer
1k
views
PHP registration script, how to check if request is coming from a credible source
I've got a php registration script, that just takes all the data as a post request. I've got another page which sends that data to the script using jQuery ajax. How can i be sure, that the request ...
- 101
11
votes
3
answers
3k
views
How To Stop A Mobile Verification Attack
I am thinking of using mobile phone number verification for the sign up step in my web application but how do I prevent a hacker or a malicious user from sending mobile verification requests to an ...
- 741
1
vote
1
answer
162
views
Risks and strategies to implement anonymous storage of Google Cloud Messaging tokens?
I'm writing a mobile app that aggregates weather data and generates a push notification when certain criteria are met. The user has the option to change some of the variables (e.g. if the current ...
- 11
0
votes
2
answers
598
views
Pros and cons of password policy filtering common weak passwords? [duplicate]
We all know the basics "password rules" when a user register on a website, such as:
more than 8 characters,
must contain an upper case letter,
must contain numbers and so on
Why don't websites ...
- 201
7
votes
2
answers
8k
views
How can we protect signup APIs from brute force registration?
This is a general question but its prompted by a fairly open API I have for a file storage service that needs to have its front door better locked down.
We have an API like POST '/signup' that just ...
- 191
1
vote
1
answer
150
views
Why is the password field blanked in the registration form if the validation fail? [duplicate]
Is it really a problem if you send back the password when the validation fail on a registration form?
I understand that the html that is sent back could be cached on the computer of the person ...
- 7,021
18
votes
3
answers
3k
views
How can you prevent email addresses from being harvested from a registration form?
When you go to a website's login form and enter the wrong credentials, the website can give you one of three error messages:
Your email is wrong
Your password is wrong
Your email or password is wrong
...
- 381
4
votes
1
answer
396
views
Asking for Password After Email Validation?
I do not want to discuss the pros and cons of email validation, but want to know if there are any potential downsides (security and otherwise) to a user entering his password only after he has already ...
- 41
5
votes
1
answer
1k
views
best practices for handling self-registration?
For example, with a bank's credit card activation/registration, that user is required to authenticate with a unique code that was mailed to their address. If they don't get that mailout-with-the-code, ...
- 51