Forum Archive

Security Concern

dwildbore

I noticed this forum does not follow best security practices for authentication error messages.
When I logged in I typed my password wrong and I was told my password was incorrect. This confirms my username was correct which is not a good thing to do. Login errors should be generic:

https://www.owasp.org/index.php/Authentication_Cheat_Sheet#Authentication_and_Error_Messages

dgelessus

I don't think it would make a huge difference, the username list is basically public anyway. The search page allows searching through usernames, and typing "@" followed by some letters in a forum post brings up an autocompletion box for usernames. And if you want to check if a username exists, you can go to https://forum.omz-software.com/user/username and see if that exists.

Also, as far as I know the forum is just an installation of NodeBB, so there's probably not much that omz can do about this anyway. If you think this is a security issue, you should report it to the NodeBB developers.