Is the Stack Overflow login secure against enumeration attacks?

Question

I just noticed that when you

1. go to https://stackoverflow.com/users/login#log-in
2. pick "Stack Exchange"
3. enter any email address
4. submit the form without entering a password

you will get a message like "no account with this email address found". This kind of feedback could be used (IMHO) to launch an enumeration attack against the platform that would give the attacker a chance to identify registered accounts. I would propose to replace this behaviour by a validation message saying "Password must not be empty".

Answer 1

I agree with the principle, generally, that indicating which aspect of the credentials is incorrect (the email or password) gives attackers a larger surface area to attack; if the system tells them that the password is wrong, they know that the email is valid. If the system tells them that the email doesn't exist, they won't expend resources on trying to attack passwords on that particular email.

However, I think that a different, more ambiguous message should be provided towards the above ends.

That said, a generic error should be given when either the username and/or password is incorrect. Something along the lines of:

We apologize, but the credentials provided (either the email and/or password) are incorrect.

And it would look like this (freehand circle omitted):

Answer 2

I tend to agree that some ambiguity might be prudent here, however it's important to consider that login and recovery attempts are heavily monitored and heavily rate limited by our front-end. It doesn't take more than a few unsuccessful attempts for the system to tell you that it's not accepting any more requests. It also doesn't say for how long, or even that it (is) a relatively short amount of time before it resets. That, alone, thwarts brute force / enumeration attacks, and it works very well.

In fact, most people that trigger such block don't realize that they signed in with Google or Facebook, and keep wondering why their email address isn't recognized. While we have improved it quite a bit, logging in to our site isn't the easiest thing to do for the non-technical, and our audience of non-technical folks is growing every day.

In my not-so-humble opinion, the whole way we handle this should probably change. It'd be really nice if the system could say "Are you sure you didn't mean to sign in with your Google / Yahoo / Facebook account?" if we've seen the email before, and then degrade to "email address or password was incorrect" (not hinting at which) if in fact we're certain they're trying to use an SE OpenID.

Put simply yes, this could be better, but I think we should go for a more holistic fix.