What risks are associated with account enumeration during verification-less signups

Question

I’m building a system that allows users to sign up without email or phone verification. Could this lead to account enumeration vulnerabilities? What steps can I take to mitigate such risks while keeping the sign-up process simple?

Answer 1

Verification-less sign-ups can, in fact, bring account enumeration flaws. The following lists the hazards and mitigating techniques to assist you achieve a balance between security and a flawless user interface:

Risks associated with account enumeration during verification-less signups:

1. Username harvesting: Attackers can systematically guess usernames to identify existing accounts, potentially leading to:
   • Targeted phishing attacks: Knowing a valid username, attackers can craft more convincing phishing emails or messages.
   • Brute-force password guessing: Enumerated usernames can be used to focus brute-force attacks on existing accounts.
2. Email address enumeration (if usernames are email addresses): Similar to username harvesting, but with email addresses, which can lead to targeted spam, phishing, or password reset attacks.
3. Information disclosure: Account enumeration can reveal the presence of specific individuals or organizations on your platform, potentially sensitive information.

Mitigation strategies to prevent account enumeration while maintaining a simple signup process:

1. Rate Limiting and IP Blocking:
   • Implement rate limits on signup attempts from a single IP address (e.g., 5 attempts per hour).
   • Temporarily or permanently block IPs that exceed these limits.
2. Username/Email Address Input Validation:
   • Use a non-indicative response for both successful and unsuccessful signups (e.g., "Signup successful. Check your email for activation links" even if no email is sent for non-existent users).
   • Avoid revealing whether the username/email is already in use (e.g., don't display "Username already taken" errors).
3. Delayed or Asynchronous Signup Confirmation:
   • Introduce a delay (e.g., 1-2 minutes) between signup submission and confirmation.
   • Use an asynchronous process, like sending a confirmation email (even if not used for verification), to make enumeration more time-consuming.
4. Captcha or Challenge-Response Test:
   • Require users to complete a CAPTCHA or challenge-response test (e.g., solving a simple math problem) during signup to hinder automated enumeration attempts.
5. Username/Email Address Randomization or Salting:
   • Internally store a hashed or salted version of the username/email, making it harder for attackers to enumerate valid accounts even if your database is compromised.
6. Monitor and Analyze Signup Attempts:
   • Regularly review signup attempt logs to identify potential enumeration attacks.
   • Use this insight to inform and refine your mitigation strategies.
7. Consider a Lightweight Verification Step:
   • If the above measures are insufficient, introduce a lightweight verification step, such as:
     • A simple, one-time SMS code send (with rate limiting).
     • A basic, automated email verification (without making it a hard requirement for signup completion).