Protecting against malicious discovery of account existence

A method of providing an enhanced sign-in service that protects against enumeration attacks comprising:

• in response to determining by a processor of a computing device that a sign-in request value associated with a username in UPN format is exceeded by a threshold value, displaying an unambiguous message regarding existence/non-existence of the username;
• in response to determining that the sign-in request value exceeds the threshold value, displaying an ambiguous message regarding existence/non-existence of the username;
• and
• always allowing access to an application utilizing the sign-in service when a valid username and authenticating credential pair is received by the sign-in service.

A sign-in system protected from enumeration attacks comprising:

• a memory connected to at least one processor, the at least one processor configured to:
• determine a threshold value for providing an enhanced sign-in experience from a sign-in service;
• in response to determining that a sign-in request value associated with a username in UPN format is exceeded by the threshold value, display an unambiguous message regarding existence/non-existence of the username;
• in response to determining that the sign-in request value exceeds the threshold value, display an ambiguous message regarding existence/non-existence of the username;
• and
• always allow access to an application utilizing the sign-in service when a valid username and authenticating credential pair is received by the sign-in service.