Is it secure (safe) to inform a user logging in that "on user with that login ID exists, please create a login"

Question

In early usability testing, I had a user click the Login button instead of Register and then try entering a variety of Email and Password combinations. Of course, they had not account.

I'm thinking that if they enter an invalid User ID (we use email addr right now) we'd say "there is no account with that ID, make sure your Registered".

I don't see this very often in other UI's though. And I suppose there's a risk that someone could try a zillion random email addresses until they get something other than "no user with that email".

I looked @ CheddarGetter.com, for example, and they don't do that. BUT if I click the "forgot my password" and then enter an invalid User ID it'll tell me then. So if it's safe to do it in the latter, it seems safe in the former.

Answer 1

No no no no no. It's not safe at all. But for usability concerns you need to tell if the forgot password email was sent or not.

I for one use six to eight different email addresses and can't remember which one I used on each site. My account would be lost forever if I couldn't get the expected feedback if the account exist or not. But safe, no!

Answer 2

Here is the best way to handle this:

1. User clicks "forgot login/password".
2. User enters their email address.
3. System sends an email to that user
   • If the user already has an account, inform them someone requested a password reset. If the user requested the change, click this link to reset.
   • If the user does not have an account, inform them someone attempted to login to the site but there is no account associated with that email. If the user would like to create an account, click on this link to register.

The advantage to this from a security perspective is that your system is not publicly displaying whether or not an account exists for that email address. It is "secure" behind the security of the user's inbox.

The advantage from a user's perspective is they just enter their email address into a single text box and press a single button and the email response they get gives them a single link to complete their task of getting access to the site.

Answer 3

You are correct in your observations regarding inconsistencies in online security. To truly protect the identity of your users, you would need to do the following:

• Never inform a user that they have the correct username (or email) but wrong password when they attempt to log in.
• When creating a new account, never inform the user that credentials that are required to be unique (username or email address, whichever you're using) have already been taken by another user.
• When the user goes to reset their password, always inform them that the "reset your password" email has been sent even if they don't have an account (and the user wastes time checking their inbox for an email that will never come).

The first point provides a poor user experience, but the other points are absolutely horrible. The "invalid username or password" pattern is followed partially out of laziness and partially for security reasons. By providing a good user experience while creating new accounts or resetting passwords, they've unwittingly leaked private information. There's no good reason not to help the user at this point.

Keep in mind that knowing where the lock is located is not the same as having the key for it.

• Many online systems make the username publicly visible (such as on a forum)
• Attempting to brute force a password for an online account is a very slow process (it is easier to compromise an account via phishing, social engineering, or by gaining access to the database itself)