search

ppau / project-m

Something secret but not really.
GNU General Public License v3.0
6 stars 8 forks source link

Find a solution to email enumeration problem #74

Open Doddzy opened 8 years ago

Doddzy commented 8 years ago

Emails of users signed up can potentially be enumerated via us not allowing duplicates. This can be an issue and should be investigated to find a solution.

More info: If you attempt to sign up as test@gmail.com, then the account creation fails, you then know that this user is in database, even if theres no message explicitly saying so, the error would clearly indicate that. Using this people can generate a list of members in our db.

bbqsrc commented 8 years ago

Allow three duplicates from one IP then ban it. :smile: