News for hackers. Stuff that matters.

A comment on Authentication Cheat Sheet. Parent comment

Re:Authentication Cheat Sheet by x1j7xJuzX on Monday February 02, 2015 @12:22PM (#8985307)
It's not a difficult problem to solve. Just let the sign-up succeed whether an account already exists for the email or not. Then say "You will receive an email with instructions to complete your registration".

If there was no existing account, send an email with the text: "An account was created for this email address at Example.com. If you requested this account, you may activate it by clicking here: https://..."

If there was an existing account, send: "An attempt was made to create a new account at Example.com for this email address, but you already have an account. If you have forgotten your password, visit https://..."

[ Parent | on HN ]
Re:Authentication Cheat Sheet by birdmanjeremy on Monday February 02, 2015 @02:06PM (#8986065)
Yes, this was the alternative we discussed. We opted to go with the simpler (and very common) signup process, which does admittedly leak some information.
[ Parent | on HN ]
Re:Authentication Cheat Sheet by jdbernard on Monday February 02, 2015 @01:19PM (#8985689)
That works for sign-up, but not for the far more common case of sign-in.
[ Parent | on HN ]
Re:Authentication Cheat Sheet by birdmanjeremy on Monday February 02, 2015 @02:07PM (#8986073)
If you use this approach, the idea is then that you use a generic login failure message. This prevents leaking of any account information, but provides a different (poorer, IMO) user experience.
[ Parent | on HN ]