New answers tagged

1

Note that this also (besides the other answers) applies to the registration screen, instead of complaining about already registered user sent them an email that they are already registered and provide no feedback about this in the web app besides "check your mail". This is best done if you ask for minimum input on the first step before the email validation (...


20

What are we protecting against? First of all one should ask what they are protecting against exactly. In this case there are two different threats: Threat 1 An attacker brute forces random emails to find valid registered emails. This could be theoretically used to create spam lists, but as far as I know has never been done as it's simpler to just sent the ...


8

You should weigh up the problem versus the inconvenience of solution. It's often a tradeoff. In my opinion it is usually better to sacrifice this bit of security for the sake of user experience unless someone might get persecuted for being registered in your site. From time to time I come years later to a site and try to find which email did I use for the ...


20

As an addition to the answers above (Would be better suited as a comment but can't do that yet) another step the hacker can take is to measure the TIME of your response to the form. It might take you 10ms to determine the email doesn't exists, while it takes you 100ms to generate a reset link and send an email. The hacker can know if the response is slower ...


102

Don't indicate that the attempt "failed". A user (legitimate or otherwise), asks for a password reset link, and gives you an email address. All you should say here is along the lines of Your submissions has been received. If we have an account matching your email address, you will receive an email with a link to reset your password. The user will still ...


31

The reason for this finding is that a user gets different responses, depending on the existence of the email address. This can be as simple as telling them that the address is not known, or something more subtle in the response. The easiest implementation to avoid this kind of problem is giving back the exact same response, no matter whether the email ...


Top 50 recent answers are included