REST API User Enumeration

Because user names are not a security issue, same as email addresses. You can, however, prevent that with a plugin such as Wordfence.

https://ww.wp.xz.cn/plugins/wordfence/

There are others but I know that that one works. No, I do not use any security plugins and I don’t believe they’re necessary myself. I have lots of reasons for that but your mileage may vary. 😉

Otto had a really good reply about that and I’m going to link and quote it here.

https://ww.wp.xz.cn/support/topic/major-security-bug-still-in-latest-version/?view=all#post-8675356

Edit: Aaaand the forums quote CSS mungs the formating. Here’s text.

++++++++++++++++++++++++
To answer your point, WordPress doesn’t consider usernames or user ids to be private or secure information. Here are a few points for your consideration:

1. On most sites, usernames are pretty readily available/visible, and users don’t treat it as private.

2. There are many places where the “username” could be disclosed. Author archives URLs contain it, it’s in the RSS feeds, it’s used in the body_class for author archives, and so forth. All of these actually use the “user_nicename”, but for most cases, this is the same as the username.

3. Most importantly, the username is not actually considered secret information. Disclosure of it is not a security risk.

With regards to the last one, consider what would be the case if the username was actually considered “private” and so strong attempts were made to hide it. In that case, we’d essentially be treating it as if it were a second password. Now, if we assume that the user already has a strong password, then the username-as-a-password is simply an additional bit of information to “add-on” to that existing strong password. So the total password strength is now their existing strong password plus the hidden username.

The problem with this sort of thinking is that, generally speaking, people are trained to pick strong passwords (hopefully), but not to pick strong usernames. So this means that they are going to be picking an easy to use/remember username, which also happens to make it particularly weak as a password. It is better to teach people to pick stronger passwords instead, making the username irrelevant.

The concept of having a second “password” is silly on the face of it, really. Consider the case where instead of a username and a password, we simply had two password fields. You have to know your first password, and your second password. Now, that seems dumb right away, doesn’t it? Because a password has no length limit, you could simply add the two passwords together and put them in one field. So, why have two of them? Similarly, why make your username complicated like a password would be? Just make your password longer and stronger.

Also, let’s consider that the “username” is kind of dead as an identifier at this point anyway. Look at Facebook and Google, for example. They don’t even have usernames, they simply use your email address as the account identifier. WordPress now supports logging in with either a username or email as well. Finding out somebody’s email address tends to be pretty easy (you share yours with everybody you send email to), so are these services insecure because there is no username used on them to begin with?

Keeping the username semi-public at least teaches people that it’s not meant to be hidden, and that they should rely on strong passwords for security. Ideally, we’d slowly phase out username altogether and just use email addresses. At least people usually remember those. Username is really a relic and a way to have friendly identifiers for other purposes (like those Author URLs).

Certainly, you can easily discover that my username on my blog is “otto”, but that doesn’t get you any closer to brute-forcing my 20+ character password, so it’s irrelevant.

Note that WordPress is not the only open source project to believe this. Drupal has similar arguments for the same thing: https://drupal.org/node/1004778
++++++++++++++++++++++++
It’s a good reply and I hope that explains it to you.

• This reply was modified 9 years, 4 months ago by Jan Dembowski. Reason: Fix quotes

User enumeration IS A RISK!!!!

Nope.

*Drinks coffee*

Please re-read the above. With strong passwords, it’s not. That’s the whole point: there are too many people who can either guess or determine your username. It’s not a secret and it was never meant to be.

Security is based on what you can control. It’s understood that your password will be secret. Usernames? That’s not the case and never has been.

*Finishes coffee*

This really isn’t an argument and I’m not trying to convince you or be convinced myself. I’m just explaining the “why” about it.

If you are really concerned about it (and I think that’s fine too) then please consider these articles.

https://codex.ww.wp.xz.cn/Hardening_WordPress
https://codex.ww.wp.xz.cn/Brute_Force_Attacks

And these plugins.

https://ww.wp.xz.cn/plugins/search.php?q=two+factor

I personally use the first plugin in that hit. One of these may help you too.

https://ww.wp.xz.cn/plugins/search.php?q=security

At least you’re being condescending about it.

That was an attempt at humor. Thank you for skipping the parts above where I tried to assist you.

I apologize for that part; I attempted levity and I managed to insult you. Don’t worry, I’ll be serious with you from now on.

I’ve corrected your formatting in your post, you really should use code and not blockqoute when you posted the output from my installation.

In addition, I’ve placed your account on moderation watch in these forums. That means further posts from you will need to be approved by a moderator before anyone else sees them.

https://codex.ww.wp.xz.cn/Forum_Welcome#Being_.27Mod_Watched.27_or_Banned

Following a moderator to their home site to… what? Prove a point? That is never a good idea.

Why do you think you know security better than OWASP?

I don’t claim that and this next part is condescending: I do claim to understand it better than you. Did you actually read that article? This is the part you may want to focus on.

Attention: by enumerating user accounts, you risk locking out accounts after a predefined number of failed probes (based on application policy). Also, sometimes, your IP address can be banned by dynamic rules on the application firewall or Intrusion Prevention System.

Yeah, I use Jetpack for that. See below.

For people reading this topic, my multisite installation URL is this.

https://dembowski.net/

The site on my WordPress network is https://blog.dembowski.net/ and the URL that @hans2504 used is https://blog.dembowski.net/wp-json/wp/v2/users and the enumerated list of users on that site is this.


andre
jan
lily


The login URL to my site is https://blog.dembowski.net/wp-login.php Have fun with that.

There are two plugins that I installed and activated which add to having a strong password. Two Factor authentication and Jetpack.

https://ww.wp.xz.cn/plugins/two-factor/
https://ww.wp.xz.cn/plugins/jetpack/

I’m sure you understand what two factor authentication is. If not then this link may help you out.

The Jetpack security features are listed here.

https://jetpack.com/support/security-features/

See the “Protect” part? That lets my installation participate with others to identify the IP sources of brute force attacks and deal with them early on. If someone is identified as the source IP of an attacker then they don’t get access to my site.

When someone attacks my site and they’re not in the database then that information is shared with others. Think about how vaccinations work, it may give you an idea about inoculating other sites from attackers.

For strong passwords I use 1password.

https://1password.com/

Last Pass is pretty good too and many of my colleagues use that.

https://www.lastpass.com/

My encrypted password store is in several places and backed up. I don’t actually know most of my passwords but they tend to be like this.

v2JXvlfYoR3ZLluGIR

The 1password app works on my phone, PC and Mac. It’s very liberating not knowing my passwords but still being able to use them when I need to.

Using strong passwords combined with a tool to detect and mitigate brute force login attempts will defeat all attempts at guessing your password.

I don’t have to use 2FA but I choose to do so because it’s cool and it protects against something else: shoulder surfing. My user ID, password and 2FA code might be seen but the 2FA code has a short life span. It’s no longer viable in a matter of seconds.

I’ve tried to do the following in this topic.

1. Answer your question about “Why has WordPress taken such an insecure stance out of the box?” and I’ve done that at length.
2. Provide some advice how you can turn off that feature via a plugin.
3. I’ve also offered links to help you harden your installation and deal with brute force attacks.

And for my effort I’ve been accused of being condescending, you followed me home to my site and intentionally posted information about my site.

Was that supposed to intimidate me somehow? Good job, you’ve done well. I’m now closing this topic as you’ve really crossed a line and that made this no longer productive.

I sincerely hope that the information I’ve posted helps you and others.