Existence of user account queryable through password reset

[mvdbeek]

          Is this message getting out of the API ? We should never reveal whether or not a user exists at an instance, that's a security and privacy concern.

Originally posted by @mvdbeek in #18459 (comment)

[martenson]

Nice catch. I remember we have fixed this long ago, but seems we reintroduced it.

[dannon]

I think it's reasonable to change the message here, but I just want to point out that if we really want to prevent leaking emails we would have to significantly change (impede) how registration works, explicitly putting the activation email in the required loop (i.e. -- you can't just register and immediately be logged in, you must click the link in the email to start your first session). Without this, the act of registering an already registered email leaks as well.

[jdavcs]

This is a good point. So, how do we communicate to a user who has an account but may have forgotten about it and is trying to register again? Should the system send an email informing that user that they have an account and ask whether they want to reset their password? Plus, display a generic message, e.g. "an activation message has been sent to the provided email address"?

[martenson]

The two tricky parts while tightening this seem to be:

• the automatic login after registration; This likely needs to be disabled otherwise it will give up the information whether the account exists.
• the instances without user activation enabled; I don't see a good solution here.

[nsoranzo]

* the instances without user activation enabled; I don't see a good solution here.

I think that's fine, it's probably only small or behind-firewall instances that don't have user activation enabled. We can still mention in the user activation settings that having it disabled allows this information leak mechanism.

[martenson]

We could also consider enabling activation by default. Or at least heartily recommend it for production settings since it complicates basic setup.