Comment by ComputerGuru
14 years ago
kpumunk and others, please note that http://www.scribd.com/password/check leaks information about whether or not a particular email address is in your system. It's hardly a critical weakness or anything, but just an FYI and something you may wish to reevaluate.
Edit: thanks for the quick fix! I would advise that a good compromise would be to change the current message from
"Good news - your password was not among those compromised. You do not need to take any action at this time."
to
"Good news - if this is the email your Scribd account is associated with, your password was not among those compromised. You do not need to take any action at this time."
Small difference, but the lack of definiteness to the response will be enough to make me think of double-checking my email (in my case, it was an email address I haven't used in years - I'm one of the first Scribd users!)
Er, what? Every single site I can think of 'leaks' this information through their registration page.
Try and sign up for a new Scribd account with an existing email:
"That email address is already taken; please choose another one"
Try to sign up for a Facebook account with an existing email:
"Sorry, it looks like somebody@somewhere.com belongs to an existing account"
Doesn't really matter, the password reset page leaks the same info and has presumably been up forever:
There is no account registered to mail 'abc@smackfu.com'.
And that's a lot harder to fix.
Why is that harder to fix? Many sites handle it properly:
"If there was an account associated with that email address we have emailed it with instructions."
Since people log in with a username, not an email, they may not know which email address they associated with the account. Especially if they used a one-off to avoid spam. Personally, I prefer systems that do a reset to email after you provide a username, since usernames are often public / verifiable anyways.
Thank you for your suggestion. Not a weakness anymore :)