new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

authentication/account_enumeration

2 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Forgot Password: return consistent message for existent and non-existent accounts

The forgot password service must return a consistent message whether the account exists or not, to prevent user enumeration attacks.

Forgot Password: ensure uniform response time to prevent enumeration

Response time for both existent and non-existent accounts should be uniform, preventing attackers from enumerating which accounts exist. This can be achieved using asynchronous calls or ensuring the same logic is followed instead of quick exit methods.

Give your agent this brain