openml / openml.org

New OpenML website
https://new.openml.org
BSD 3-Clause "New" or "Revised" License
25 stars 18 forks source link

Failed login message differs when user name exists from when it does not #247

Closed PGijsbers closed 2 years ago

PGijsbers commented 2 years ago

When a user does not exist you get the message "User does not exist", but if the user exists and the password is wrong it gives "Wrong username or password". image

For security reasons, the login form should not leak information of registered users but the current page allows you to identify which e-mail addresses are registered with OpenML.

Maybe it is even possible to use existing package/library/framework/whathaveyou to handle this, since there are also other characteristics by which this can be mined (if the error message is the same, it can still leak through e.g., the latency of the error message).