thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Username Enumeration

Determining which usernames or emails are valid from differences in an application's responses.

Definition

Login, registration and password reset pages often reveal validity through different messages, status codes or response times. Mitigations include generic messages ('If the account exists, an email was sent'), consistent response times and rate limiting.

Example

The login page says 'unknown user' for invalid names but 'wrong password' for valid ones.

Exam tip

Use generic error messages for both cases.

Related terms