118
votes
Accepted
Is it unsafe to show message that username/account does not exist at login?
This is a consideration between security and usability, and therefore there is not really a right answer here. So here follows my opinion.
If you can keep usernames secret, then do so. In this case ...
- 34.4k
100
votes
Password reset giving clues of possible valid email addresses
Don't indicate that the attempt "failed". A user (legitimate or otherwise), asks for a password reset link, and gives you an email address. All you should say here is along the lines of
Your ...
- 806
34
votes
Is it unsafe to show message that username/account does not exist at login?
It's not the only OWASP guideline that is not followed by big players. OWASP often focuses on security and ignores usability. It can be a valid design choice if combined with a decent password policy, ...
- 1,830
30
votes
Password reset giving clues of possible valid email addresses
The reason for this finding is that a user gets different responses, depending on the existence of the email address. This can be as simple as telling them that the address is not known, or something ...
- 7,545
24
votes
Password reset giving clues of possible valid email addresses
What are we protecting against?
First of all one should ask what they are protecting against exactly. In this case there are two different threats:
Threat 1 An attacker brute forces random emails to ...
- 1,384
20
votes
Password reset giving clues of possible valid email addresses
As an addition to the answers above (Would be better suited as a comment but can't do that yet) another step the hacker can take is to measure the TIME of your response to the form. It might take you ...
- 311
14
votes
Is it unsafe to show message that username/account does not exist at login?
You just can't prevent it. (Unless you're ready to sacrifice a significant amount of usability.)
User enumeration can be undesirable and there are indeed potential security implications (e.g. if an ...
- 45.1k
9
votes
Password reset giving clues of possible valid email addresses
You should weigh up the problem versus the inconvenience of solution. It's often a tradeoff.
In my opinion it is usually better to sacrifice this bit of security for the sake of user experience ...
- 269
7
votes
Is it unsafe to show message that username/account does not exist at login?
Safety is relative. It is slightly safer not to give out information about whether the account exists or not. But that doesn't mean that it is unsafe to give out that information. It is just less safe,...
- 286
6
votes
Accepted
Why would an attacker try SMTP login many times even though it is disabled?
Attack code is often a hastily scripted affair, poorly written and without proper error handling. It’s probably only checking for a a 200 OK response, and retrying in case of any non-200 response.
...
- 34.7k
6
votes
Accepted
What attacks are possible if you can scrape a list of users?
There are a few ways this could be an issue:
Considering some of the fallout of the Ashley Madison hack, being able to confirm whether or not a person has an account on a given site can be of value. ...
- 3,661
5
votes
Accepted
Is it vulnerable to let users know their own and other users id from a database?
It really depends on what you can do with that knowledge, Ask yourself the following questons:
As a user of the site do I need to know my ID to use it?
If a user knows their own ID what does that ...
- 1,920
5
votes
Why do several bug bounties ignore user enumeration?
In addition to @Bacon Brad's excellent answer above, I would like to include three more reasons as to why "user enumeration" is often listed under the "out of scope bugs" sections in security policies....
- 1,336
4
votes
Dealing with violating privacy of registered users during failed authentication
It's an interesting question, because I never thought of this problem, but it is indeed a privacy issue. The problem is that certain procedures actually leak information, which can even be sensitive ...
- 15.9k
4
votes
Accepted
Dealing with violating privacy of registered users during failed authentication
I like how the GDPR states: "implement appropriate technical and organisational measures". Now you should take a risk based approach to define appropriate. In sensitive cases like second love this ...
4
votes
Accepted
Should I be concerned about the WordPress REST API's user enumeration vulnerability?
It's difficult to reliably prevent the enumeration of Wordpress users as there are multiple different ways they can be leaked. Besides the REST API approach, an attacker can also loop through author ...
- 45.1k
3
votes
Is it unsafe to show message that username/account does not exist at login?
I agree with @Silver's answer, but want to expand. Keep in mind the context; the OWASP guidelines are meant as rules of thumb for developers who are not security experts. If a software development ...
- 59.3k
3
votes
Accepted
Pentesters: Is it common for bruteforce/ dictionary attacks, e.g. for SSH username enumeration, to be successful in the real-world pentests?
Password brute-forcing against SSH isn't the first place I'll go to, in part because I tend to find a fairly low success rate, and also because many systems will have some kind of account lockout - ...
- 16.6k
2
votes
How did hackers brute force my Windows server username?
There are few ways to enumerate windows usernames, but maybe they only needed RDP.
You don't need the username or password to start a rdp connection, and some windows versions (not sure which ones, ...
- 884
2
votes
What attacks are possible if you can scrape a list of users?
Usually username enumeration is seen as a first step towards bruteforce or dictionary-based attacks; if you know a username is valid, then you know you aren't completely wasting your time trying to ...
- 9,462
2
votes
Windows registry keys not preventing users/group enumeration via null session
I've recently performed a detailed experimental analysis on what causes the null session user enum to work and to fail. For anyone else trying to reproduce the vulnerable behavior, this is what I ...
- 21
2
votes
How to secure email validation endpoint?
Edit to answer actual question
Sorry for misunderstanding your question. That being said, here is an answer. If your goal is to make it so that no one knows what email addresses you have registered ...
- 31.7k
1
vote
Password reset giving clues of possible valid email addresses
Note that this also (besides the other answers) applies to the registration screen, instead of complaining about already registered user sent them an email that they are already registered and provide ...
- 983
1
vote
Accepted
Preventing account enumeration with 2FA
Only allow the front-end to ask if it should show the 2FA UI after the password has already been authenticated.
This doesn't even have to be a separate API, it could be part of the existing login API....
- 15.8k
1
vote
Accepted
Are my Windows 10 User Accounts exposed?
Attackers will often aggregate useful offensive knowledge. A good example is combo listing, where cracked passwords and matching usernames are made into giant lists which are passed around.
It could ...
- 572
1
vote
Accepted
Is the common recommendation to obscure the existance of a username on login just security theater?
Sometimes there is a legitimate reason for such a protection. To give one example I've personally observed (details elided), the website for a medical provider that specializes in a particular kind of ...
- 52.1k
1
vote
How to secure email validation endpoint?
It’s not clear what threat you are trying to handle.
There are some options, which I‘ll outline from the top of my head:
information leakage for a single email
You will have to deny registration at ...
- 14.5k
1
vote
Is it unsafe to show message that username/account does not exist at login?
It's probably too hard to say they violate the OWASP guideline, because for applications and service like Google, Microsoft, they need to be as much as possible "user compliant".
Moreover, they all ...
- 42
1
vote
Accepted
PSExec not working against windows XP (metasploit)
Try setting the SMBDomain to a single dot "." or the system name rather than WORKGROUP and see what happens.
- 310
Only top scored, non community-wiki answers of a minimum length are eligible