Mitigating risk of account enumeration

摘要

Technology is disclosed for mitigating account enumeration and thus enhances network security. The technology can receive from a client computing device a sequence of characters corresponding to a portion of an email address input by a user. The technology retrieves a set of email addresses that have a common first portion identical to the received sequence of characters and generates hashed data. The hashed data is sent to the client computing device. A result value is then generated by hashing the input email address by using the same hashing function as the hashed data. If the result value is in the hashed data, the technology displays a text region for collecting from the user a password.

主权项

1. A system, comprising:
a server computing device having:
a processor and memory;a first component configured to:
receive from a client computing device a sequence of characters; andretrieve from a database a set of account information that have a common first portion that is identical to the received sequence of characters; andlimit the set of account information to a specified maximum number;a second component configured to provide, to the client computing device from which the sequence of characters was received, a hashed data and a complexity value; and the client computing device having:
a processor and memory;a third component configured to initially display in a user interface a first text region to collect from a user an account name, without displaying in the user interface a second text region to collect from the user a password;a fourth component configured to:
monitor an initial sequence of characters received in the first text region for collecting the account name;transmit the sequence of characters to the server computing device;receive from the server computing device the hashed data and the complexity value;monitor an additional sequence of characters received in the first text region for collecting the account name, the additional sequence of characters entered after transmitting the sequence of characters to the server;hash, using the hashing function, the initial sequence of characters, and the additional sequence of characters based on the received complexity value to generate a result value;determine whether the result value is in the received hashed data; andin an event the result value is in the received hashed data, display the second text region for collecting from the user a password corresponding to the collected account name.