4

Sorry, I was not able to formulate the title shorter.

Today I stumbled across the password recovery from Dropbox. Here, users have to enter their email address and Dropbox says:

If a Dropbox account exists for [email protected], an e-mail will be sent with further instructions.

https://www.dropbox.com/[email protected]

But what is the reason behind this? First, I thought they try to prevent attackers from randomly guessing email addresses and checking whether they are registered or not. Imagine you know that [email protected] is registered to, e.g., craigslist. This might be a great privacy issue in some cases.

But then I remembered that your email is checked against all existing email addresses when a new account is registered.

So, what is the reason behind this behavior?

Improve this question

3 Answers 3

Reset to default
9

First, I thought they try to prevent attackers from randomly guessing email addresses and checking whether they are registered or not. Imagine you know that [email protected] is registered to, e.g., craigslist. This might be a great privacy issue in some cases.

This is precisely the reason why so many websites have implemented it that way and that's the reason I've seen given everytime this has been brought up.

But then I remembered that your email is checked against all existing email addresses when a new account is registered.

... and this is precisely the reason why it's almost always pointless to do so.

Jeff Atwood (co-creator of StackOverflow and Discourse) explored this in a blog post, The God Login, and sums it up like this :

We're deadly serious about picking safe defaults for Discourse, so out of the box you won't get exploited or abused or overrun with spammers. But after experiencing the real world "which email did we use here again?" login state on dozens of Discourse instances ourselves, we realized that, in this specific case, being user friendly is way more important than being secure.

Improve this answer
2
  • 1
    This blog post is very interesting to read, thx! What do you think about something like rate-limiting, i.e., we can't let a possible attacker spam thousands of addresses or do not give any informations about whether this account exist or not after let's say 3 wrong attempts? However, using the registration process for such an "attack" might be not feasible since users often have to enter some captacha before submitting the form, this might be an approach for the password reset process as well.
    – Nils Q.
    Commented Jul 31, 2017 at 8:50
  • To add to this answer, I'm guessing they (sites like DropBox) prevent this on the reset password page and not the registration page because that's where malicious users will look to first.
    – Alan
    Commented Aug 3, 2017 at 14:52
8

You don't want anyone knowing even that someone has an account.

If a malicious actor is searching for info on someone, it could be potentially damaging just knowing that someone even has an account / is a member of an organization.

Each piece of info is a betrayal of a users right to privacy.

To go further, let's say you have an organization or app that a government in some countries considers hostile or controversial. A citizen even registered could be in danger just by allowing anyone who had their email address to see that they are at the very least a registered user ( regardless of actual activity or participation).

Improve this answer
5
  • 6
    Correct, but an attacker can gain this information anyway when they try to register an account with the address. Therefore, this step does not increase the privacy but creates additional inconvenience.
    – Nils Q.
    Commented Jul 30, 2017 at 17:43
  • Ah, true. Good point
    – Mike M
    Commented Jul 30, 2017 at 17:44
  • 1
    @NilsQ. Not that it is that much more work, but the second option does take a bit more time to check into. A state actor might be willing to do the extra work, most other malicious actors will, however, move to easier targets.
    – user102492
    Commented Jul 31, 2017 at 4:54
  • @GypsySpellweaver That's an interesting idea. I also forgot that most websites use some captcha when you register an account, that might get triggered when you try to spam many different email addresses, which might provide some additional security against such attacks
    – Nils Q.
    Commented Jul 31, 2017 at 8:52
  • The point about easier targets is important. Malicious users are still users. Each layer of inconvenience, no matter how trivial, reduces conversions -- in this case, fraud. By the same token, there is no silver bullet - you will likely never prevent fraud outright, but you can under ideal circumstances reduce the incidence and impact to trivial scales.
    – Nathan Christie
    Commented Jul 31, 2017 at 16:38
1

You got the rationale right. This is a protection from letting someone check whether someone is registered at a service.

You also got right that, if you try to create an account, it will give you an error if it is already registered. HOWEVER:

When you are trying to find an account to hack, you want to only check. You don't want to create an account. So unless they implemented their login flow wrong, all you can check in this case is whether a user has an account or you (or someone else) already tried to create an account to find out whether it already existed.

So, this is an additional level of protection, because a hacker has to choose a "noisier" point of ingress, and risks tainting the result via their attempt to check.

Improve this answer
2
  • This doesn't make much sense... if I want to get any access, I first try to register with a few emails until I find some already existing. Then I try tons of common passwords. As the latter part is much more demanding, going through the former doesn't count.
    – maaartinus
    Commented Aug 3, 2017 at 11:45
  • 1
    In addition to what @maaartinus wrote, it might be sufficient to know whether the account exist at all, e.g., whether your husbands email address is registered at e.g. pornhub. So this is not just a security concern but also a privacy problem
    – Nils Q.
    Commented Aug 4, 2017 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.