#31505: Document possible email address enumeration in PasswordResetView.
-------------------------------------+-------------------------------------
Reporter: Mohammad Almazroa | Owner: felixxm
Type: | Status: assigned
Cleanup/optimization |
Component: Documentation | Version: 3.0
Severity: Normal | Resolution:
Keywords: User Enumeration | Triage Stage: Accepted
Security Bug |
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Florian Apolloner):
Replying to [comment:6 Mohammad Almazroa]:
> A random sleep time should be within the range that the
"PasswordResetView" is taking to send an email. This way it is not clear
what response time that means valid or not valid email.
But you don't know how long sending emails takes, so it will just be a
relatively good guess at best which does not help since it can be
determined via enough requests…
--
Ticket URL: <https://code.djangoproject.com/ticket/31505#comment:8>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/064.bf42bdab0ba67e576bcb2e50afa807c0%40djangoproject.com.
