torrust
Mitigate the risk of information leakage through sign-up forms
When you use an email that has already been used by another user you get a message like this:
That allows users to easily check is a user with a given email is registered. Although this is very common behavior in a lot of online services, for example, LinkedIn:
I think we should try to mitigate it.
Proposal 1
Add a captcha and/or a rate limit (IP) to the registration form to at least make it harder to automatize checking a list of emails.
Proposal 2
- Make the email always optional in the sign-up form.
- Remove configuration option
email_on_signup. The email would be always optional. - Allow email duplicates. You can sign up with somebody else's email.
- The application does nothing with the user's email unless is validated. This should be always the case. For example, to reset passwords, send notifications, etc. For the time being, the email is only verified when
email_verification_enabledoption is enabled. The user's email is not used for anything else.
# ...
[auth]
email_on_signup = "Optional"
# ...
[mail]
email_verification_enabled = false
from = "[email protected]"
reply_to = "[email protected]"
username = ""
password = ""
server = ""
port = 25
# ...
Both proposals are compatible.
cc @torrust/torrustaceans
Option 3:
Do not register the user until the email has been validated.
- Ask the user to enter email.
- Send email to user: a. Send registration link, if unregistered. b. Send "you already have an account" email, if already registered.
- User completes registration, logs in, or reset password.
Option 3:
Do not register the user until the email has been validated.
- Ask the user to enter email.
- Send email to user: a. Send registration link, if unregistered. b. Send "you already have an account" email, if already registered.
- User completes registration, logs in, or reset password.
Option 3:
Do not register the user until the email has been validated.
- Ask the user to enter email.
- Send email to user: a. Send registration link, if unregistered. b. Send "you already have an account" email, if already registered.
- User completes registration, logs in, or reset password.
Hi @da2ce7 I think that is what the program does when email_on_signup is Required and email_verification_enabled is true. But currently it also tells you that the email is taken. We could simply allow duplicate emails, but a user could mistakenly write a wrong email which is valid. In that case, would be impossible to re-use that account (username).
@josecelano @da2ce7
I would do the following:
- Don't allow users to register until they verify their email adress.
- Add a captcha and/or a rate limit (IP) to the registration form to at least, make it harder to automatize checking a list of emails.
- I would NOT allow to have more than one account with the same email
- If a user tries to sign up/log in with someone's else's email, we could send a security warning to that email every time, letting that user know that someone is trying to sign up or sign in using that email.
I also think it could do some more research on this topic and see how other apps implements it.
