Brute force account discovery
Bug #1564758 reported by
Thibaud Lopez Schneider
on 2016-04-01
This bug affects 3 people
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| | Canonical SSO provider |
Low
|
Maximiliano Bertacchini | ||
Bug Description
Hello,
The following Launchpad pages are subject to brute force account discovery:
* login page, https:/
* password recovery page, https:/
* registration, https:/
They will tell if an email address is already registered or not without throttling, limit, or CAPTCHA. There should be.
Thank you,
--Thibaud
Related branches
lp:~maxiberta/canonical-identity-provider/fix-429-crash
- Adam Collard (community): Approve on 2018-12-21
-
Diff: 78 lines (+26/-1)2 files modifiedsrc/webui/tests/test_views_registration.py (+16/-0)
src/webui/views/registration.py (+10/-1)
lp:~maxiberta/canonical-identity-provider/prevent-forgot-password-user-enumeration
- Tom Wardill: Approve on 2019-01-14
-
Diff: 284 lines (+59/-49)5 files modifiedsrc/api/v20/handlers.py (+3/-4)
src/api/v20/tests/test_handlers.py (+4/-3)
src/identityprovider/tests/openid_server/per_version/test_sso_workflow_reset_password.py (+2/-7)
src/webui/tests/test_loginservice.py (+24/-22)
src/webui/tests/test_views_registration.py (+26/-13)
lp:~maxiberta/canonical-identity-provider/registration-throttling
- Adam Collard (community): Approve on 2018-12-21
-
Diff: 77 lines (+14/-6)3 files modifieddjango_project/settings_base.py (+1/-0)
src/api/v20/handlers.py (+1/-1)
src/api/v20/tests/test_handlers.py (+12/-5)
| affects: | ubuntu-website → launchpad |
| information type: | Private Security → Public |
William Grant (wgrant)
on 2016-04-01
| affects: | launchpad → canonical-identity-provider |
Daniel Manrique (roadmr)
on 2018-06-07
| Changed in canonical-identity-provider: | |
| status: | New → Confirmed |
Maximiliano Bertacchini (maxiberta)
on 2018-12-18
| Changed in canonical-identity-provider: | |
| assignee: | nobody → Maximiliano Bertacchini (maxiberta) |
Maximiliano Bertacchini (maxiberta)
on 2018-12-19
| summary: |
- Launchpad brute force account discovery + Brute force account discovery |
Maximiliano Bertacchini (maxiberta)
on 2018-12-20
| Changed in canonical-identity-provider: | |
| importance: | Undecided → Low |
| status: | Confirmed → In Progress |
Next rollout includes the following improvements:
- Significantly tighten the registration view throttling limit.
- Fix registration and forgot password views to show a nice "rate limit exceeded" error message.
- Show "Check your email" page on password forget view for non-registered emails, the same as with registered emails.
| Changed in canonical-identity-provider: | |
| status: | In Progress → Fix Committed |
Maximiliano Bertacchini (maxiberta)
on 2019-01-16
| Changed in canonical-identity-provider: | |
| status: | Fix Committed → Fix Released |
To post a comment you must log in.
This may help:
https:/
http://