Every system has a login feature, and it’s an indispensable battleground that developers, users, and even hackers all target first. The login logic has been discussed a lot online, but there’s one pitfall beginners easily forget: the message returned in the login or forgot-password feature reveals whether an account exists.
Thoughts Triggered by a Slow-Running System
A client reported that a system was running slowly, yet the system didn’t have many users — puzzling. Checking the access logs revealed that the most-requested interface was the “Forgot Password” feature! That’s abnormal; someone must have been exploiting it.
A normal login interface returns “wrong account or password” — you can’t tell whether the account or the password was wrong. But the forgot-password interface returns something different.
The forgot-password feature first asks for the account, then asks for a verification code in the next step to reset the password. If the first step fails, it returns “account does not exist”!
The Pitfall of Revealing “Account Does Not Exist”
So what pitfall awaits you if you reveal “account does not exist”? First, if you don’t reveal it and only say “wrong account or password,” then a credential-stuffing attacker has two variables to guess — both the account and the password — and the chance of successfully cracking one out is nearly zero.
But if there’s a place where a hacker can learn whether an account exists, the variables are halved: if the account doesn’t exist, there’s no need to guess the password. So determining whether an account exists is their first step, which leads to the “Forgot Password” feature being called heavily.
Solution
First, neither the “Login” nor the “Forgot Password” / “Forgot Account” logic should return an error saying the account doesn’t exist. You can return something like “If the account exists, a verification-code email will arrive in your inbox,” so the hacker can’t exploit this logic flaw to probe whether an account exists.
Second, if changing the logic is troublesome, you can add a complex CAPTCHA on the page to block bots from calling the interface. Although there are recognition and bypass methods online, once the difficulty goes up most hackers will give up. As long as you reach the point where hackers give up, that’s enough.