Preventing username enumeration
portswigger.net | blog | #web-security | #authentication | #portswigger | #timing-attacks | #account-recovery | #username-enumeration | #account-registration
Summary
Preventing username enumeration takes more than uniform errors: timing and HTML differences leak answers, and registration needs designs like app-chosen usernames to avoid revealing valid accounts.
- Published
- Collected
--- id: 2325 title: "Preventing username enumeration" source_domain: portswigger.net source_url: "https://portswigger.net/blog/preventing-username-enumeration" published_at: "2007-04-22T11:54:00Z" tags: ["web-security", "authentication", "portswigger", "timing-attacks", "account-recovery", "username-enumeration", "account-registration"] phying_url: "https://phying.com/item/2325" lang: en --- # Preventing username enumeration ## Summary Preventing username enumeration takes more than uniform errors: timing and HTML differences leak answers, and registration needs designs like app-chosen usernames to avoid revealing valid accounts. ## Intelligence Metadata - **Sources:** portswigger.net - **Published:** 2007-04-22T11:54:00Z - **Original:** https://portswigger.net/blog/preventing-username-enumeration - **Phying News:** https://phying.com/item/2325