Engineering / ENG-1731
Lockout tells an attacker which email addresses have accounts
Description
Found reviewing the lockout after release.
Steps to reproduce
- Try 11 wrong passwords for an email that has an account: the lock message.
- Try 11 wrong passwords for an email that doesn't: "That email or password is wrong." for ever.
The difference tells anyone which emails are ours, which is exactly what the lists in OPS-41 were testing.
Fix
Count failures per email as typed, whether or not an account exists, and show the same lock message.
Linked issues
- relates to ENG-1720 Lock message says when the person can try again Done
- relates to ENG-1705 Lock an account's password sign-in for 15 minutes after ten failed passwords in 15 minutes Done
Counter keyed on a hash of the lowercased email. Same message both ways; timing checked, both paths hash a password.