13

It is common on login forms to see "Email or password is incorrect" when the user types in their account details incorrectly instead of just "password is incorrect". This is, for among other reasons, because it is a security vulnerability to inform users that the Email is indeed registered to that site. You can read about it in this question.

However, in the case of a "Forgot password" reset page, there is only an input for the user to enter an Email to get a new password sent to them. If this email is not registered to my site and I put an error message saying "Sorry this email is invalid" then a malicious person can come in and try emails until they find one that doesn't give that error, meaning they've found an active account.

Is there any way to avoid divulging this potentially risky information?

I can only think of possibly limiting the number of attempts to put in an email as it shouldn't impede a normal user experience.

Improve this question
1
  • I don't know what happen just if I trying to see my account you say email or password doe's not exist
    – Ibrahim abubakar
    Commented Dec 6, 2020 at 18:06

3 Answers 3

Reset to default
23

The easiest way to implement this is to say

If a matching account was found an email was sent to [email protected] to allow you to reset your password.

I've seen this on a few sites lately, though at the moment they are all escaping me. It struck me as a great way around this issue.

It confirms to them if they entered the email account they intended to, and if they have an account they'll be getting an email any time now.

Improve this answer
7
  • DigitalOcean does this, regardless of what you type (even if it's an invalid email address - wrong format) you get the generic "If the email you specified exists in our system, we've sent a password reset link to it."
    – Drown
    Commented Nov 17, 2015 at 21:08
  • You may run into issues where an email may end up in Junk/Spam folder or maybe even gets delayed. A user will keep punching in different email addressed with a frustration if he/she does not get an email from the system. (I've seen many cases like that in the past)
    – Igorek
    Commented Nov 17, 2015 at 21:09
  • @Igorek A valid user is going to exhibit that same behavior no matter what message you show them. You can mention in your message that sometimes emails aren't instant and that checking the SPAM/Junk folder is a good idea, but that user will always just assume something got lost and come back and fill in the form again. The point here is to keep all data out of the hands of invalid users.
    – Arielle Lewis
    Commented Nov 17, 2015 at 21:14
  • @DoyleLewis. I respectfully disagree. I might be an exception here, but I would think it's a sub par experience to have me keep guessing. If you tell them an email has gone out, they would be expecting to get it. If you tell them "if you guessed your login email correctly, we will email you" type of a message you force the user to guess and complete more actions. Based on a personal experience, It is very frustrating.
    – Igorek
    Commented Nov 17, 2015 at 21:26
  • 1
    @DasBeasto I'd just like to point out, that malicious users can still attempt to figure out if an email exists, by trying to register with a new account using that email. Since most (if not all) services require unique addresses upon registration. Or do you have a solution for that?
    – Dan
    Commented Nov 1, 2016 at 15:00
2

You could implement a security question(or two) into the "forgot password" process, which would basically act as a password to get/reset your password. So both the email address entered and the security questions answered would need to all match, validating the user is legit.

Improve this answer
-1

I think you've answered your own question to the most part. I don't think it is a bad idea to show if the account you are trying to log into cannot be found by the login name provided. I would propose to:

  • Show "Account not found" type of a message if the login is wrong
  • Show "Login failed" type of a message if the login is found by password is wrong

To your other questions:

  1. Yes, it is ok to show a message to the user if the email address provided was not found in the system.
  2. Yes, You should limit the number of attempts from the same source and if exceeded, block the source for a period of time (some do 15 minutes, some websites block for hours and longer.
  3. Yes, implement security check. I agree with dmoz to the most part. Instead of asking a series of security questions - instead implement CAPTCHA or a similar solution for the "forgot password" feature.
Improve this answer
1
  • 2
    Why do you think it's OK to reveal the account/email exists?
    – josemigallas
    Commented Aug 22, 2023 at 10:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.