In today’s fast-paced digital landscape, the quest to create user-friendly products often takes centre stage. Companies strive to captivate users with intuitive interfaces, seamless experiences, and feature-rich applications. After all, a delightful user experience is a key driver of customer satisfaction and brand loyalty. However, there’s a profound challenge lurking beneath the surface – that pits user experience against an equally vital element: security.

This post delves into the intricate balance between product features and security, exploring a specific security issue that is part of this challenge: user enumeration. As organisations push the boundaries of user-centric design and accessibility, they often make design and technical choices that unintentionally compromise security. User enumeration, a vulnerability that allows attackers to uncover sensitive user information, is a prime example of this delicate balance.

In our interconnected world, where digital services are woven into the fabric of our daily lives, understanding this balance is more critical than ever. Users demand frictionless experiences, but they also expect their data to be safeguarded. Striking the right equilibrium between enhancing user experience and fortifying security is a continuous and evolving endeavour.

The UX-First Approach: Balancing Accessibility and Security

Objective: Creating the Easiest Registration Flow

In the pursuit of a seamless user experience, companies often strive to design registration processes that are effortlessly intuitive. One common goal is to streamline the onboarding process, ensuring that new users can sign up swiftly and without friction. However, one UX-driven feature that frequently finds its way into registration flows is the immediate check for existing user data, be it email addresses or phone numbers.

The Use Case: Streamlining Registration with Real-Time Validation

Imagine a scenario where you’re building an application or website, and you want to offer potential users the simplest registration experience possible. To achieve this, you decide to implement real-time validation of user data during the registration process.

When a new user enters their email address or phone number, the system promptly checks whether that information already exists in your system. If it does, the user is immediately prompted on the UI, allowing them to take corrective action without having to go through the entire registration process only to find out later that their chosen identifier is unavailable.

Heading for Technical Requirement: Implementing Server-Side Email Address Validation

Now that we’ve explored the use case and recognised its potential to streamline the registration process, our next step is to define and implement the essential technical requirement: enabling server-side checks against our user dataset to verify whether an email address is already in use.

To accomplish this, we can create a straightforward API endpoint that returns either “True” or “False” based on the email’s existence in our database:

GET /api/[email protected]

{
“emailExists”: true
}

With this functionality in place, we can enhance the frontend’s responsiveness. Now, we can promptly inform users whether their chosen email address is already in use before they proceed. On the surface, it appears to be a simple implementation that greatly improves user experience. However, let’s take a closer look at what’s happening behind the scenes.

Under the Hood: The Technical Implications of Fast Validation

Currently, we face two issues within our implementation. The first concern revolves around adhering to security best practices. Specifically, it involves the practice of not transmitting sensitive information as query parameters within the URL. The practice poses a significant risk as it can inadvertently lead to the logging of personally identifiable information (PII) in our system. In our current setup, the email address, which is sensitive information, remains visible as part of the URL.

The issue raises the importance of designing API endpoints with security in mind. It’s imperative to address this vulnerability through a more secure approach. However, the potential security risks go beyond this point and could result in the compromise of user data, warranting a closer examination of our implementation.

User Enumeration in the Wild: Real-Life Exploits

When examining the technical implementation of our server-side validation, we must ensure that it meets the following criteria for functionality:

• Efficiency: It should provide quick responses, returning a simple “true” or “false” to expedite the registration process.
• Unauthenticated Access: Given that this validation is used during user registration, it should be accessible to users who are not yet logged in, meaning it should not require authentication.
• Public Accessibility: The validation endpoint must be accessible by anyone in the public domain, as our registration process is open to the public.

While adhering to these criteria is essential for a smooth registration process, it raises a critical concern. By allowing validation of email addresses in the public domain, we inadvertently expose knowledge of our users’ email addresses and their status as registered platform users. This exposure poses a potential security risk that warrants careful consideration and mitigation.

The Attack: How this is exploited

Now that our API endpoint is in place to validate a user’s email address, it inadvertently becomes accessible to potential attackers who may seek to exploit it for malicious purposes, such as harvesting a large number of user emails.

From a user’s perspective, this process might seem cumbersome, involving manual testing of various email address permutations, which can be time-consuming. However, for an attacker, this task is far from challenging. It can be accomplished with ease using just a few lines of code within a simple loop. Attackers can exploit a repository of previously leaked email addresses or, employ a rainbow dictionary containing possible permutations of email addresses associated with common email providers or organisational domains.

This raises a critical security concern, as our API’s accessibility inadvertently creates a potential avenue for attackers to gather user email addresses, thereby solidifying the importance of addressing this vulnerability promptly.

The Risk: User Compromise

With an attacker now possessing a list of validated user email addresses, they can proceed to execute a range of campaigns aimed at compromising user’s security:

• Phishing Attacks: Armed with the knowledge of valid registered email addresses, attackers can launch targeted phishing campaigns. By leveraging this information, they can send deceptive emails and text messages to specific users, aiming to deceive them into disclosing sensitive information or credentials. Attackers often create a sense of urgency and fear, especially in scenarios like fintech systems, where they claim a user’s account is compromised or at risk of suspension. The urgency prompts users to take swift action, often without critically evaluating the legitimacy of the message, making them vulnerable to falling for phishing attempts.
• Exploiting Compromised Passwords: Attackers can also attempt to gain unauthorised access to user accounts using previously compromised passwords associated with the identified email addresses. While it is considered best practice to use unique passwords for each platform, many users use the same password across multiple accounts. Attackers take advantage of this common oversight, attempting to access users’ accounts on various platforms using known compromised passwords associated with their email addresses. The practice can be especially effective when users have not updated their passwords or enabled two-factor authentication.

These tactics illustrate the potential consequences of user enumeration, highlighting the need for robust security measures and user education to protect against such threats.

The Solution: Designing Everything with Security in Mind

Understanding the vulnerabilities and risks associated with user enumeration is the crucial first step towards adopting a proactive approach that ensures both seamless user experience flows and the safety and security of user data.

Balancing features like immediate email validation with robust security measures is indeed possible without making unnecessary trade-offs or exposing users to potential attacks.

Some strategies to enhance email validation security while maintaining user-friendly design:

• Implement Rate-Limiting: To mitigate the risk of brute force attacks and discourage attackers from exploiting unauthenticated validation endpoints, consider implementing rate-limiting. By limiting the number of requests from specific sources, such as IP addresses, you reduce the impact of automated attempts to harvest valid email addresses. While this may not make exploitation impossible, it significantly reduces its effectiveness.
• Employ Server-Side CSRF Validation: Utilise server-side CSRF (Cross-Site Request Forgery) validation by generating unique frontend tokens upon page load. This approach helps prevent user enumeration by limiting the origin of requests for validation providing a unique identifier for rate-limiting purposes. It adds an extra layer of security to your validation process.
• Strive for Sensitive Information Obfuscation: Achieving a balance between user experience design and security is key. Even having a simple “true” or “false” next to an email address to mark it as valid is useful and valuable information, and can be used for malicious purposes in the wrong hands. While exposing certain information to end-users can enhance their experience, it should never come at the cost of creating a security vulnerability. Plan and design with care, ensuring that just enough information is communicated to the frontend without compromising security. Finding this equilibrium is crucial for providing both usability and protection.

These strategies empower you to enhance security without undermining the user experience, ultimately creating a safer and more user-friendly environment for your platform’s users.

Conclusion

Balancing user experience and security is a nuanced endeavour that should be an integral part of the planning and design process when introducing new features. It calls for collaboration software and security experts, product owners, and UX designers. Together, these teams can openly discuss and assess the risks associated with specific features, ultimately finding a harmonious equilibrium that not only ensures a seamless user experience but also upholds a strong security posture. This proactive approach sets the stage for the development of feature-rich products that excel in user-friendliness and security.

This is one of the many user enumeration issues we encounter in production. These kinds of enumeration vulnerabilities are seen in registration, login and forgotten password forms in a lot of instances.

At Deimos we strive to bring security awareness and design into all phases of the software development life cycle, and work closely with all team members in the design and implementation of features to ensure that security best practices are applied and that there is a good balance between usability and security in features built. To learn more, click here.