Hi. I have a question about the change email flow via Account/Profile settings. Seeing that it is vulnerable to account enumeration (responds with

An account with the same identifier (email, phone, username, ...) exists already.

), what protections, rate limits, detection mechanisms does Ory Network have in place to prevent a user from abusing this?

For what it's worth, you can probably override / replace this message in the settings.after webhook 😎

True, but the message text doesn’t really matter. If we don’t update the user’s email, then it would signal that email is already in use anyway.

Fair - how do you suggest to solve it? Just update the email anyways? 😛

In our current system, we just send an email to the new email. The user has to click a link in the email to actually trigger the change.

So what does the email say if the identifier (ie, the email address) already exists? It's not a bad solution, it's kinda smart

And the app just displays, “You’ll receive an email with further instructions”.

Yeah, makes sense

Hi. Is it possible for someone from the Ory team to comment on my original question? Thanks.

there is some settings, i.e. you have to require verification and there is an option to enable sending a login attempt email but there is still some limitations: https://github.com/ory/kratos/issues/133

We have the “Attempted verification notifications” turned on. I guess I am more interested in what the rate limits are and how Ory enforces it? We can live with some enumeration as long as it can’t be abused.

we are still working on refining those request specific rate-limits, but we have abuse detection & prevention through cloudflare, as well as global rate-limits, which already works very well what specific scenarios are you envisioning? I'd suggest you try the attack you need to be protected from, and see how well it works we're happy to take it from there and adjust the rate-limiting

The scenario would just be someone repeatedly calling the following endpoint, https://www.ory.sh/docs/reference/api#tag/frontend/operation/updateSettingsFlow, and searching for a

An account with the same identifier (email, phone, username, ...) exists already. (4000007)

error.

this case will typically be handled by cloudflare very well, but we could set stricter rules for the endpoint if we see the need

Thanks.