Sign in Subscribe
Security Tips

Security Tip: Don't Forget Your Registration Form!

[Tip#72] We talk a lot about protecting password reset and login forms, but don't forget about the humble registration form, it can provide attackers with crucial intel!

Stephen Rees-Carter

Stephen Rees-Carter

— 2 min read
Security Tip: Don't Forget Your Registration Form!

I was procrastinating browsing Twitter and came across this wonderful meme:

The full text is replicated below the meme.
Credit: Tim Myers @denvercoder

In the first panel we have what is presumably a login form error message, giving an ambiguous message to obfuscate which input is incorrect:

“Error. Either your email or password is incorrect.”

Followed by the response from the registration form, which confirms the email address is in the database:

Register > Enter Email: ”Sorry that email is taken.”
AH, it’s the password.

Upon seeing this, my first reaction was…

This is why ambiguous messaging on password reset forms is often pointless.

Folks spend so much time worrying about the password reset form leaking account existence and ensuring it has rate limiting, but what about the humble registration form?

Not only do they usually tell you if an email address is already in the database, but they also often lack sufficient rate limiting, and don’t send out any emails, so you can usually use a registration form to check if email addresses are in the database much faster and quieter than with a password reset form.

😈
Password Reset forms are often covered by heavy rate limiting, with verbose logging and alerting. While validation errors on registration forms are typically completely ignored. I know which I'd rather attack!

So this week, I want you to remember your humble registration form!

  1. Ensure it has rate limiting that includes any validation failures.
  2. If account attacks or credential stuffing are a concern, log those validation failures so you’re aware of malicious activity.
  3. If the existence of email addresses is supposed to be secret, don’t validate emails on the registration form!
💡
Most apps don’t actually need to worry enumeration attacks, as user existence doesn’t reveal anything compromising, and the only benefit is to slow down credential stuffing attacks.

However, if your app does need to protect user identities, your registration form shouldn’t validate email addresses. Instead, it should just collect all the user's information and notify the provided email address - either to inform the existing account owner of the attempt, or to confirm ownership of the address and continue the registration flow.

See In Depth: Registration Without Enumeration for more information on this topic.

Read more