What attacks can be directed on a registration page

Answer 1

I guess you should use a salt when hashing the passwords.

Answer 2

Use Captcha so that a bot cannot automatically create multiple accounts

Answer 3

Use HTTPS, i.e. a combination of HTTP and SSL to provide encryption and secure identification of the server when submitting sensitive data like a password. The main idea of HTTPS is to create a secure channel over an insecure network. This ensures reasonable protection from eavesdroppers and man-in-the-middle attacks, provided that adequate cipher suites are used and that the server certificate is verified and trusted.

Answer 4

Filter user's data removing '<', '>' - simply html tags. If someone can view user's profile there are possible XSS attacks through data.

Answer 5

1. Use HTTPs or encrypt passwords before submition with MD5 and Javascript in clientside.
2. Use Captcha.
3. limit allowed characters for username.for example alphabet and numbers, dash(-) and dot(.).

PS. clientside encryption is not a secure way.but if you cant use HTTPs,clientside encryption a good solution.

and about limiting characters,its a simple way to protect your webware from injections(SQL/XSS).

Answer 6

You should use e-mail verification

and addition to Koosha's answer : if you let usernames including such chars "#&?/" and create user pages like this site.com/user?me&you/ it may be serious problem in browsers. Please think it in url address bar of browsers.

Answer 7

If the routes on your website are set in a particular way (ie, going by the username, rather than their id), then having a username like 'admin' could cause problems. You should probably have an exclude list of possible usernames.

This caused problems in the past with MySpace, and people having usernames like login, and then decorating their page with a phishing form.

Edit:

As has been mentioned in the comments by AviD and Peter Boughton, it is also a way of misleading users. Let's say that a user has the username 'admin'. Then, in their user information page (assuming that they each get one that is available to all, like SO), they have some link in their about section that says like

For more information, visit our dev blog at mysite.cn/loginpage

Someone maybe sees, 'mysite' in the url, but doesn't really look at the TLD, which would be China (sorry China!), rather than the .com TLD your site is hosted on. So they click through, assuming it's alright (they came from the admin user page after all), and this site looks identical to yours but has a login page. So you 're-enter' your details, but nothing happens. Or it redirects you elsewhere.

This is often the tactic of bank scammers who wish to target customers, inviting them to go to their website to 're-enter a banking password'.

This is just one more form of a type of security known as 'Social Engineering'.

Answer 8

Use recaptcha or asirra to avoid automatic submission. That should stop the bots and script kiddies.

To stop hordes of humans from submitting spam (via mechanical turk or anything like that), log each attempt in memcached and as soon as you reach a maximum submissions from the same IP in a given period of time, block that IP for a few minutes (or hours, days, whatever...).