Other nomination
Enumerating logins via Abuse of Functionality vulnerabilities
Reports that the username-availability checkers on large sites are an abuse-of-functionality flaw that leaks valid logins. On YouTube's signup form the Check Availability AJAX response distinguishes existing from free names, and with no anti-automation the check can be brute-forced over a wordlist to build a list of real accounts for password attacks.
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.