7

It is common on login forms to see "Email or password is incorrect" when the user types in their account details incorrectly instead of just "password is incorrect". This is, for among other reasons, because it is a security vulnerability to inform users that the Email is indeed registered to that site. You can read about it in this question.

However, in the case of a "Forgot password" reset page, there is only an input for the user to enter an Email to get a new password sent to them. If this email is not registered to my site and I put an error message saying "Sorry this email is invalid" then a malicious person can come in and try emails until they find one that doesn't give that error, meaning they've found an active account.

Is there any way to avoid divulging this potentially risky information?

I can only think of possibly limiting the number of attempts to put in an email as it shouldn't impede a normal user experience.

11

The easiest way to implement this is to say

If a matching account was found an email was sent to user@email.com to allow you to reset your password.

I've seen this on a few sites lately, though at the moment they are all escaping me. It struck me as a great way around this issue.

It confirms to them if they entered the email account they intended to, and if they have an account they'll be getting an email any time now.

  • DigitalOcean does this, regardless of what you type (even if it's an invalid email address - wrong format) you get the generic "If the email you specified exists in our system, we've sent a password reset link to it." – Drown Nov 17 '15 at 21:08
  • You may run into issues where an email may end up in Junk/Spam folder or maybe even gets delayed. A user will keep punching in different email addressed with a frustration if he/she does not get an email from the system. (I've seen many cases like that in the past) – Igorek Nov 17 '15 at 21:09
  • @Igorek A valid user is going to exhibit that same behavior no matter what message you show them. You can mention in your message that sometimes emails aren't instant and that checking the SPAM/Junk folder is a good idea, but that user will always just assume something got lost and come back and fill in the form again. The point here is to keep all data out of the hands of invalid users. – Doyle Lewis Nov 17 '15 at 21:14
  • @DoyleLewis. I respectfully disagree. I might be an exception here, but I would think it's a sub par experience to have me keep guessing. If you tell them an email has gone out, they would be expecting to get it. If you tell them "if you guessed your login email correctly, we will email you" type of a message you force the user to guess and complete more actions. Based on a personal experience, It is very frustrating. – Igorek Nov 17 '15 at 21:26
  • Sorry, i am a bad user and have 6 e-mails that i use for my everyday activities. Many times when i forgot a password for a given website i will try at least two of them until i get one response. One time i had to call to get my account deleted and register again (since it was registered to an e-mail that i lost). It's not fine to make a user guess if they entered the correct mail. And all of this without considering a user typo. The EXPERIENCE is better with more information, but SECURITY is worse. It's a choice to offer great EXPERIENCE or great SECURITY but, sometimes, you cannot have both. – Gabriel Fonseca Nov 17 '15 at 21:34
0

You could implement a security question(or two) into the "forgot password" process, which would basically act as a password to get/reset your password. So both the email address entered and the security questions answered would need to all match, validating the user is legit.

-1

I think you've answered your own question to the most part. I don't think it is a bad idea to show if the account you are trying to log into cannot be found by the login name provided. I would propose to:

  • Show "Account not found" type of a message if the login is wrong
  • Show "Login failed" type of a message if the login is found by password is wrong

To your other questions:

  1. Yes, it is ok to show a message to the user if the email address provided was not found in the system.
  2. Yes, You should limit the number of attempts from the same source and if exceeded, block the source for a period of time (some do 15 minutes, some websites block for hours and longer.
  3. Yes, implement security check. I agree with dmoz to the most part. Instead of asking a series of security questions - instead implement CAPTCHA or a similar solution for the "forgot password" feature.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.