WordPress.org
Get WordPress

Make WordPress Core

Changes between Initial Version and Version 1 of Ticket #45318


Ignore:
Timestamp:
11/09/2018 02:05:48 PM (8 years ago)
Author:
SergeyBiryukov
Comment:

Hi @d0rkpress, welcome to WordPress Trac! Thanks for the report.

Just noting this has been previously reported a few times, most recently in #40667.

As stated in the ​handbook article you've linked to, we don't consider usernames (and by extension, the existence of accounts) to be private. A similar thing can be achieved just by browsing the /author/{slug} views.

We need to balance user friendliness with information disclosure and as ​usernames are not considered private information, user friendliness wins here.

Please don't ignore the warning that Trac displays when creating security tickets. If you believe you've found a vulnerability, please ​disclose it to us privately, ​via HackerOne.

Related: #3708, #4290, #5301, #12129, #22421, #27125, #31787, #40667.

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #45318

    • Property Keywords close added; Authentication needs-patch removed

  • Ticket #45318 – Description

    initial v1  
    77Yes, I read that: https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/#why-are-disclosures-of-usernames-or-user-ids-not-a-security-issue . But it in 2018 it is time to change this. You need just to look into any logfile of any webserver you will find lots of probes for the WordPress login.
    88
    9 The threat is that it is minimizing for an attacker considerably the effort by a 2 x square root factor. Let's say in 1000 user accounts I have one hit on a web site, for a password guess I have another 1 in 1000 hits. Without a login oracle I would need 1000^2 tries to get a hold of a login. With this oracle I need 1000 + 10000 tries. One million requests vs. 2000 makes a huge difference.
     9The threat is that it is minimizing for an attacker considerably the effort by a 2 x square root factor. Let's say in 1000 user accounts I have one hit on a web site, for a password guess I have another 1 in 1000 hits. Without a login oracle I would need 1000!^2 tries to get a hold of a login. With this oracle I need 1000 + 10000 tries. One million requests vs. 2000 makes a huge difference.
    1010
    1111Please