2

Within a secure password reset function of a web application where the email address is the unique account identifier, what would be the best way to handle password reset requests where no matching account is found for the email address entered - i.e. the user hasn't created an account within the application.

For security reasons (to guard against 'valid account harvesting'), we're avoiding direct in-browser notification like No account exists with this email address and instead using a generic If an account exists with this email address you will be sent an email with instructions to reset your password. More on this can be read in this question Reset password, appropriate response if email doesn't exist?

If no account exists with the specified email address, should the user simply receive no email at all? Or would it be better to send a different email to the entered address along the lines of

A request was made using this email address to reset a user account password at www.example.com.
unfortunately no account has been created with this email address.

If you didn't request this, you can safely ignore this mail and take no action.

If you're trying to log into our site, you can go to www.example.com/register to create a new account.

edit: I'm interested here in what's the better experience for the user. On one hand, they are informed that they don't have an account and directed to the page where they can create one so uncertainty is reduced. On the other hand, it's been pointed out to me that malicious users can enter somebody's email into a site over and over and generate multiple emails (although we have CAPTCHA on the reset password form to guard against this being done by script).

Improve this question

1 Answer 1

Reset to default
2

Tell me exactly how you prevent email address harvesting on your registration page? Now, please, tell your users if they've entered the wrong email address... Just with my university account I have 4 email address to handle (why? no clue). It can be a nightmare to reset a password under those conditions.

To answer your question, yes, it is a good idea to let users know so they know that they should be expecting spam since someone knows their email address.

Improve this answer
3
  • Thanks for your answer Steve. Valid account harvesting is guarded on the login and forgot password pages by never confirming in browser if an entered email address has a valid associated account. So an attacker in theory shouldn't be able to get a list of valid users with which they could then attempt to crack passwords. The registration page is a little more tricky as we would need to tell a user that an account exists if they try to register again using the same email ID, so perhaps the whole conversation is moot, but that's a bit outside the scope of this particular question.
    – Harley B
    Jan 15, 2016 at 13:08
  • That is what I wanted to point out to. There are few Web services where harvesting on registration is impossible (and even if you rate limit registrations, attackers can distribute their attack to counter that). And because of that, there is generally no point in ruining the life of your users on your login / forgot password forms. Withholding feedback is wrong, as memory interference on logins can also occur with user identities. There is no quantitative data on the impact of forgotten ids in the wild but it's an issue that comes up in interviews in our password studies every now and then.
    – Steve Dodier-Lazaro
    Jan 15, 2016 at 14:00
  • Thank you Steve, very good feedback! I was looking at a potential two stage registration where the message on submission is 'You will receive an email with further instructions to complete your registration'. For a valid new registration, a one time login is created and a link to verify is emailed which completes the registration. For pre-existing registrations, the user gets an email informing them that they have an account with a link to the login page. Something like this could guard against registration harvesting to an extent, but at a cost of a more onerous registration process.
    – Harley B
    Jan 15, 2016 at 15:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.