Mitigate the risk of information leakage through sign-up forms about torrust-index HOT 4 OPEN

Relates to: #306

from torrust-index.

Option 3:

Do not register the user until the email has been validated.

1. Ask the user to enter email.
2. Send email to user:
   a. Send registration link, if unregistered.
   b. Send "you already have an account" email, if already registered.
3. User completes registration, logs in, or reset password.

from torrust-index.

Option 3:

Do not register the user until the email has been validated.

1. Ask the user to enter email.
2. Send email to user:
   a. Send registration link, if unregistered.
   b. Send "you already have an account" email, if already registered.
3. User completes registration, logs in, or reset password.

Option 3:

Do not register the user until the email has been validated.

1. Ask the user to enter email.
2. Send email to user:
   a. Send registration link, if unregistered.
   b. Send "you already have an account" email, if already registered.
3. User completes registration, logs in, or reset password.

Hi @da2ce7 I think that is what the program does when email_on_signup is Required and email_verification_enabled is true. But currently it also tells you that the email is taken. We could simply allow duplicate emails, but a user could mistakenly write a wrong email which is valid. In that case, would be impossible to re-use that account (username).

from torrust-index.

@josecelano @da2ce7

I would do the following:

1. Don't allow users to register until they verify their email adress.
2. Add a captcha and/or a rate limit (IP) to the registration form to at least, make it harder to automatize checking a list of emails.
3. I would NOT allow to have more than one account with the same email
4. If a user tries to sign up/log in with someone's else's email, we could send a security warning to that email every time, letting that user know that someone is trying to sign up or sign in using that email.

I also think it could do some more research on this topic and see how other apps implements it.

from torrust-index.