← Graph

Timing-Based Enumeration

concept 2 connections

Enumeration variant where the attacker measures response-time distributions for known-absent vs. candidate emails. Synchronous work (sending emails, ActiveRecord callbacks, Redis pool waits) lengthens the response when an account exists, so thousands of requests produce distinguishable timing distributions. Prevent by deferring all existence-dependent work to a background job (e.g. Sidekiq) so every request returns after the same constant work, and by rate-limiting login forms by email (with IP fallback to prevent lockout-based DoS).

category
pattern
talk Devise pitfalls and way to tighten security
about
Timing-Based Enumeration concept
Section on how timing leaks account existence even with neutralized messages.
takeaway Make existence checks asynchronous to prevent enumeration
about
Timing-Based Enumeration concept
Prevents timing attacks by constant-time responses.

Provenance

Created in
Devise pitfalls and way to tighten security — Rafał Rothe... 2026-04-17 21:52
Read by
4 extractions