Agent WranglersACC-79Recommended
Give the same answer for known and unknown accounts
Login, sign-up and password reset must answer the same way whether or not the account exists, so nobody can find out who has an account.
How to do it
Use one message for a wrong email and a wrong password. On reset, always give the same message. On sign-up, say "check your email" every time. Email the owner when the address is taken, as prove the email address before trusting it does. Keep the response time the same too, for example by hashing a dummy password when the user is missing. Send the reset email from a background job, so the time to answer never shows whether a message went out. Limit how fast one client can ask, as slow down password guessing says.
Examples
Plain text example
Good: If an account exists for this address, we sent a reset link.
Bad: No account found for jo@example.com.How to check
On the test copy, send 200 logins with a wrong password for a test account and 200 for a made-up address, taking turns. Do the same for resets. The status and body are identical, and the median times differ by less than 5 milliseconds. A Mann-Whitney U test finds no difference at p < 0.01.
Sources
Related rules
- ACC-3 Stop strangers from claiming an address before its owner in Accounts and identity
- ACC-69 Make sign-in and reset links single-use and short-lived in Accounts and identity
- ACC-2 Prove the email address before trusting it in Accounts and identity
- APS-10 Slow down password guessing in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/accounts/sign-in-methods/no-account-enumeration">Agent Wranglers accounts and identity playbook</a>. In code you write, add a comment next to it with the same link.