Proposed best practice: Don't reveal presence/absence of email addresses
|
Feross Aboukhadijeh <feross@...>
On Aug 12, 2022 at 8:22:36 AM, David A. Wheeler <dwheeler@...> wrote:
|
||||||||||
|
|
||||||||||
|
FYI, I was just told that "don't reveal if account exists from a password reset"
is *already* an OWASP recommendation in their "Forgot Password Cheat Sheet", here: https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html That's strong evidence, to me, that this is already considered a best practice by many. --- David A. Wheeler |
||||||||||
|
|
||||||||||
On Aug 11, 2022, at 6:56 PM, Feross Aboukhadijeh <feross@...> wrote:There's no need to tell them *incorrect* information, just don't reveal what you don't need to reveal. Here's the current proposed text: * If a user tries to create an account using an email address, don't tell the user if an account with that email address already exists. Similarly, if a user tries to do a password reset using an email address, don't tell the user if there is no account with that email address. Providing that information would allow an attacker to determine if a specific email address is being used (or not) by some existing account. See: https://github.com/ossf/secure-sw-dev-fundamentals/pull/80/files It's not hard to do (I just did this in the best practices badge application). --- David A. Wheeler |
||||||||||
|
|
||||||||||
|
Feross Aboukhadijeh <feross@...>
Even if you hide this information in password reset, it’s usually possible to find it by attempting to register an account. I’m not sure this recommendation is worth the reduced usability. Unless we also recommend telling users they successfully registered an account when they in fact did not because the email was already used. Feross
|
||||||||||
|
|
||||||||||
|
eric.tice@...
+1, This is a great point.
Respectfully,
From:
openssf-wg-best-practices@... <openssf-wg-best-practices@...> on behalf of Christine Abernathy (F5 Networks) via lists.openssf.org <c.abernathy=f5.com@...> CAUTION:This email is received from an external domain. Open the hyperlink(s) & attachment(s) with caution.
This is a definitely a best practice to add.
--
From:
openssf-wg-best-practices@... <openssf-wg-best-practices@...> on behalf of Dave Russo <drusso@...> EXTERNAL MAIL: bounce+76904+210+6791241+11276350@...
Internal to Wipro |
||||||||||
|
|
||||||||||
|
Christine Abernathy (F5 Networks)
This is a definitely a best practice to add.
--
From:
openssf-wg-best-practices@... <openssf-wg-best-practices@...> on behalf of Dave Russo <drusso@...> EXTERNAL MAIL: bounce+76904+210+6791241+11276350@... |
||||||||||
|
|
||||||||||
|
Dave Russo
+1
toggle quoted message
Show quoted text
On 8/10/22 11:31 AM, David A. Wheeler wrote:
I propose tweaking the "fundamentals" course with text to recommend |
||||||||||
|
|
||||||||||
|
+1
toggle quoted message
Show quoted text
Cheers, CRob Director of Security Communications Intel Product Assurance and Security -----Original Message-----
From: openssf-wg-best-practices@... <openssf-wg-best-practices@...> On Behalf Of David A. Wheeler Sent: Wednesday, August 10, 2022 11:31 AM To: openssf-wg-best-practices@... Subject: [openssf-wg-best-practices] Proposed best practice: Don't reveal presence/absence of email addresses I propose tweaking the "fundamentals" course with text to recommend *not* revealing the presence/absence of email addresses in account creation & password resets. Here's the proposed text: * If a user tries to create an account using an email address, don't tell the user if an account with that email address already exists. Similarly, if a user tries to do a password reset using an email address, don't tell the user if there is no account with that email address. Providing that information would allow an attacker to determine if a specific email address is being used (or not) by some existing account.This is captured in this pull request: https://github.com/ossf/secure-sw-dev-fundamentals/pull/80 Do people generally agree that's a good/best practice when such functions exist? --- David A. Wheeler |
||||||||||
|
|
||||||||||
|
Brian Fox (Sonatype)
+1 On Wed, Aug 10, 2022 at 11:31 AM David A. Wheeler <dwheeler@...> wrote: I propose tweaking the "fundamentals" course with text to recommend |
||||||||||
|
|
||||||||||
|
I propose tweaking the "fundamentals" course with text to recommend
*not* revealing the presence/absence of email addresses in account creation & password resets. Here's the proposed text: * If a user tries to create an account using an email address, don't tell the user if an account with that email address already exists. Similarly, if a user tries to do a password reset using an email address, don't tell the user if there is no account with that email address. Providing that information would allow an attacker to determine if a specific email address is being used (or not) by some existing account.This is captured in this pull request: https://github.com/ossf/secure-sw-dev-fundamentals/pull/80 Do people generally agree that's a good/best practice when such functions exist? --- David A. Wheeler |
||||||||||
|
|
