News for hackers. Stuff that matters.

A comment on An incident impacting 5M accounts and private information on Twitter. Parent comment

Re:An incident impacting 5M accounts and private information... by unethical_ban on Tuesday August 09, 2022 @11:16PM (#32407513)
It's a solved problems that you never confirm or deny the registration of an identity (like email or phone) for your service.

Bad login? "Not a valid user/pass combo"

Password recovery? No matter what email or phone provided, simply say "If the email matches our records, we will send a recovery link".

[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by DharmaPolice on Wednesday August 10, 2022 @04:33AM (#32409254)
What about new user sign up? Most systems will tell you if an email address has already been registered (and it seems hard to get round that).
[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by vinay_ys on Wednesday August 10, 2022 @04:42AM (#32409312)
You can always show that message after email is verified. Don't reveal information without verifying the ownership of email or phone number.
[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by brabel on Wednesday August 10, 2022 @01:24AM (#32408062)
Until the UX team comes in and demands "better error messages".
[ Parent | on HN ]
Re:An incident impacting 5M accounts and private information... by unethical_ban on Wednesday August 10, 2022 @01:54PM (#32415951)
Possibly, but a good org will empower security teams to make that call and collaborate with UX on a safe compromise.
[ Parent | on HN ]