SecLab
Authentication & SessionwalkthroughDifficulty 3/525 min

Account enumeration: four channels, not just the error message

Objective: After this lesson you can find the four channels that reveal an account exists, and know why unifying error messages closes only one.

V6CWE-200A07:2025info-disclosure
Step 1 of 5 · read5 min

Why "this email does not exist" is a problem

Account enumeration is the vulnerability everyone knows half of: the half that is known is the error message, and the other three channels are not.

First, why it is a problem — because this is where people wave it away with "an email is not a secret":

  • It turns a list of emails into a list of users. A list leaked from elsewhere filters down to "people who have an account here" — and that is the target list for password spraying with already-breached passwords.
  • For some services, having an account is itself sensitive. A mental-health app, a legal service, a job board: confirming alice@corp.local has an account discloses something about Alice.
  • It is step one of every attack on authentication. Nobody brute-forces an email they do not know exists.

Four channels, and the bottom three stay open after you unify the error messages:

ChannelHow it showsWhy it is hard to close
1. Error message"Email not found" vs "Wrong password"Easiest — one string
2. Response timingA non-existent email returns faster because there is no hash to verifyNeeds deliberate slowing
3. Registration flow"Email already in use" at sign-upCannot be silent — the user needs to know
4. Password reset"Email sent" vs "No such account"Same shape as 1, at a different endpoint

Channel 2 deserves the most attention because it is exposed by the fix for channel 1. Hashing with Argon2id deliberately costs 50–100 ms. If the email does not exist, the code returns early and hashes nothing — so the response comes back in 5 ms. That 20x difference is reliably measurable over a network, and it says precisely what the error message was just fixed not to say.

Channel 3 is the one that cannot be fully closed, and that is a genuine trade-off to decide rather than ignore.

View path

Comments

Join the discussion
Sign up to comment

Commenting needs an account with at least one completed lesson. That condition is what keeps this thread worth reading: every point belongs to someone who can be asked back, and reputation accrues over time.

Sign upSign in

You can still read every comment below without an account. Signing in brings you back to this exact spot, not to the top of the page.

Loading comments…