Thank you all for your valuable input and perspectives on this bug. For me, this is very straightforward and not complicated at all: there’s a well-known bug present in Discourse which has been repeatedly surfaced by administrators and security professionals like myself, and it is being treated as a feature instead of as a security vulnerability: NIST: CWE-200: Exposure of Senitive Information to an Unauthorized Actor.
Justifying this unsafe default configuration that is in violation of industry standard best practices by citing a hypothetical situation where a forum administrator is inundated with user inquiries about which emails they used for sign-up doesn’t make sense as using the ‘forgot my password’ page would not necessitate this administrator interaction regardless of the configuration of this setting: if the more secure and standards compliant setting is enabled then the user would simply check their email(s) on the forgot my email dialogue and see whether or not that address received a password reset email, exactly as explained by the dialogue, and as is common across all modern, privacy-respecting, standards compliant web apps. Further, justifying this violation based on the premise that other sites might also be violating best practices is not a logical or compelling argument from a security and data protection perspective. I struggle to understand why we are giving administrators the ‘feature’ of making their Discourse installation marginally less secure and standards compliant for no clear benefit.
Nevertheless, I’ve done the work you’ve prescribed @sam:
1. Google: does not allow user enumeration.
2. YouTube: does not allow user enumeration (because it uses Google login, and Google doesn’t allow user enumeration).
3. Facebook: officially allows user enumeration via their ‘find an account’/‘forgot my password’ page only if the user has deliberately marked their email/phone number as public, and yet has famously leaked 500M users’ data through this type of vulnerability, and has paid out thousands of dollars to security auditors who have found that their rate limiting and ‘only if explicitly marked as public’ rules were not being followed internally.
4. Instagram: allows user enumeration (and got burned because of it). This is a different hack than the one I mentioned for Facebook.
5. X (please be respectful about dead-naming on this forum): allows user enumeration via their forgot password page, but implements rate limiting and a few other easily circumvented hurdles and still famously compromised their users’ phone numbers through an bug in their implementation of rate limiting and data privacy protections.
6. Baidu: allows user enumeration on forgot email page, and implements captcha (and maybe rate limiting? My chinese is bad). Interestingly, the recovery process requires opening an appeal with the administration team, rather than a simple recovery email. Very typical of CCP central control.
7. Wikipedia: does not allow user enumeration.
8. Yahoo: Allows user enumeration via their forgot password page, but implements rate limiting and captcha. I could not find examples of Yahoo getting caught in controversy or paying out hackers who exploit this bug, but it is really hard to search for Yahoo on any search engine for obvious reasons.
9. Yandex: allows user enumeration on login page, implements captcha and challenge question on forgot email page.
10. Whatsapp: does not allow user enumeration. PC login is via mobile credentials. Mobile credentials are bound to your phone number. There is no logout button, nor a login page/forgot my email page.
11. XVideos: does not allow user enumeration.
12. PornHub: does not allow user enumeration.
13. Amazon (e-commerce site): allows user enumeration via their forgot password page, in direct violation of their own best practices recommendations for Amazon Web Services’ Cognito user pools product. I could not find examples of Amazon getting caught in controversy or paying out hackers who exploit this bug, but it is really hard to search for Amazon on any search engine for obvious reasons.
14. Xnxx: does not allow user enumeration. The main site doesn’t really have a login page, and the ‘gold’ site doesn’t allow user enumeration. I found a defunct login page on the mobile version of the regular site, and it simply doesn’t have ‘forgot my email’ functionality at all (and is also apparently defunct, in favor of their ‘gold’ website).
15. Tik Tok: does not allow user enumeration. Enforces MFA on forgot password page.
(21. Reddit: Does not allow user enumeration. They are compliant with industry standard best practices.)
Of the top 15 sites on that list, 8/15 DO NOT allow user enumeration (or 9/16 if you include Reddit, and arguably add 0.5 for Facebook since it is only allowing enumeration of information the user deliberately approved making public), and at least 3/7 of the sites from that list that DO allow user enumeration have faced critical security events as a result of that decision.