#31505: Document possible email address enumeration in PasswordResetView.
-------------------------------------+-------------------------------------
Reporter: Mohammad Almazroa | Owner: felixxm
Type: | Status: assigned
Cleanup/optimization |
Component: Documentation | Version: 3.0
Severity: Normal | Resolution:
Keywords: User Enumeration | Triage Stage: Accepted
Security Bug |
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Mohammad Almazroa):
Replying to [comment:8 Florian Apolloner]:
> Replying to [comment:6 Mohammad Almazroa]:
> > A random sleep time should be within the range that the
"PasswordResetView" is taking to send an email. This way it is not clear
what response time that means valid or not valid email.
>
> But you don't know how long sending emails takes, so it will just be a
relatively good guess at best which does not help since it can be
determined via enough requests…
You are totally correct.
And I just saw your comment in github for using "a 3rd party package that
allows to send emails asynchronously", I didn't thought of that at all.
Keep up the good work <3
--
Ticket URL: <https://code.djangoproject.com/ticket/31505#comment:9>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/064.d1db02f9aa15c80a2fef00140925cf75%40djangoproject.com.
