Default Messages Should Not Divulge If Username Exists about passport-local-mongoose HOT 6 CLOSED

It doesn't matter as you can ascertain this anyway if you have unique username during registration. Security through obscurity never works out well.

from passport-local-mongoose.

Even still, it's another hurdle for potential attackers to overcome before actually ascertaining if a username does exist.

from passport-local-mongoose.

Attackers don't attempt login first, they check whether they are registered, then they do the brute forcing. The easiest way of doing this? Registering as the user, or checking a public profile page, or api request with the username if you're doing a username based attack, some apis provide email lookup. Aside from this the other way attackers gather access is to get the database itself but that's another can of worms.

So not really seeing where this hurdle is.

from passport-local-mongoose.

Fair enough, but as a general rule of thumb, it's a good idea to follow OWASP recommendations.

from passport-local-mongoose.

I have no idea why OWASP never responds to discussions... but here is this note anyway - https://www.owasp.org/index.php/Talk:Authentication_Cheat_Sheet#Correct_Response_Example

from passport-local-mongoose.

My intent was not that these error messages would be displayed to the user. In the next version of passport-local-mongoose these errors and error messages will get refactored to make it hard for developers using passport-local-mongoose to divulge authentication error details.

from passport-local-mongoose.