Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

When your registration form is using a user ID that is the same as their email address, I'm somewhat concerned over spammers using the "User name is in use" as a means to validate the existence of an email, or if there are other concerns I need to know of for validation sake (for instance, converting CaMeLcAsE to lowercase seems to be the status-quo despite the RFC spec).

This question is not about OpenID.

share|improve this question
1  
Before you accept anyone's username or password, I strongly suggest you read this. You mention OpenID (and that you're not using it) which makes me suspect that you are aware, but I want to make this clear for other people why might come by that collecting usernames and passwords is generally something that's not nessesary in this day and age. –  Mark Henderson Dec 15 '10 at 21:31
add comment

3 Answers

up vote 2 down vote accepted

They can only tell if it's a valid email address if that person has registered with your site, so it all depends on how popular your site gets.

I don't think that converting it to camelcase will change anything as they can easily convert to lower case or upper case if necessary.

Have you thought of putting a captcha on the site? Google's ReCaptcha is always a good one.

Update

You could put a "flipper" around the captcha code (and the code that validates it).

See how Flickr and Forrst do it

share|improve this answer
    
I've been considering captcha, but I don't really want to run with that unless I have a spammer problem... anyone spamming my site would need to design a program specifically for my site. I'm sure there's questions on the site already regarding it's implementation that I could check out. –  Incognito Dec 15 '10 at 15:14
    
See original post - I've put some more suggestions –  Piers Karsenbarg Dec 15 '10 at 15:38
    
@user1725 If you display any user generated content, don't be surprised if spammers do write an application specific to your site - they've done it for one of mine (and even updated it a couple of times as my heuristics improved) –  Rowland Shaw Dec 16 '10 at 8:38
add comment

This is a non-issue if you return the same message for both of the following cases:

  • Invalid login/invalid pass
  • Valid login/invalid pass

It is generally a bad idea to tell a user that his login is valid but his pass is invalid: doing so allows an attacker to find valid logins.

Sorry, my mistake - if this is just a concern for registration then why not apply the same principle (share no information regarding account existence) and just let users re-register the account with the e-mail provided (chances are they've forgotten their password so instead of sending the new registration e-mail just send an e-mail with a link to reset the account password).

share|improve this answer
1  
This is the registration process, not the sign in. –  Incognito Dec 15 '10 at 23:21
add comment

You should make sure the email address is not only real but in the control of the registrant. Send an email to that address with an activation link inside. Make visiting that link a requirement for activating their account. That way you know the email is both real and in the control of the user.

One check you may want to consider making is checking the DNS records of the email address's domain name to make sure MX records are set up for that domain. This helps to weed out fake emails account like something@asfasdfasdf.com. Just keep in mind that it is possible to setup your mail records in such a way that this check will fail for some legitimate email addresses. I've never had that problem but it is something to keep in mind.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.