Privacy Concern

Hello, I'm Graeme from District 73 Toastmasters. My club is Guiding Stars Toastmasters, number 28678498.

I'm also the District 73 Technology Manager. In that capacity, I received an email from a member of the Hawthorn club (#00005028) saying that the autocomplete on the user login screen is actually a privacy concern, as anyone can use that to enumerate the names of every member of the website's club.

I agree, and wanted to bring this to your attention. I also wanted to make sure I wasn't reporting something you already know about, but my searches of the forums couldn't find anything related.

So, I respectfully submit this report to the support forum.

Subject: Privacy Concern: Unauthenticated Member Name Enumeration via Form Input Autocomplete
Club / District: District 73: Guiding Stars Toastmasters #28678498, Silver Service Leaders #00001644
System Area: Member Login / Public Form Input Fields

Issue Summary

When an unauthenticated public visitor interacts with the member name input field on a public FTH website, entering 4 or more characters triggers a dynamic drop-down menu suggesting full names of active club members.

This behaviour presents a user enumeration vulnerability. It allows unauthenticated visitors to confirm specific individuals' membership and enables automated scripts to harvest member rosters using common name dictionaries.

Steps to Reproduce

1. Open a browser in **Incognito / Private Browsing mode** (ensuring you are completely logged out).
2. Visit any public FTH club website.
3. Locate the member name input field (e.g., in the Member Login box or public interaction form).
4. Type a 4-letter name prefix (e.g., `"Fion"`, `"Mich"`, `"John"`, or `"Dave"`).
5. Observed Result: A dynamic drop-down appears displaying the full names of active club members matching those characters.

Privacy & Security Impact

• Bypasses Member Privacy Preferences: FTH allows members to opt out of appearing on the public "Meet Our Members" directory. This auto-complete behaviour undermines that setting by publicly revealing members' full names without their explicit consent.
• Targeted Verification Risk: Anyone attempting to verify if a specific person belongs to a club (e.g., for unwanted contact or tracking) can easily confirm their full name and affiliation by typing the first four letters of their name.
• Dictionary Scraping / Harvesting: An automated script using a dictionary of common 4-letter first-name prefixes (e.g., `john`, `sara`, `mark`, `davi`) can query the public endpoint and systematically extract a club's membership roster in seconds.
• Targeted Phishing: Scrapers use harvested member names to construct targeted spear-phishing campaigns (e.g., impersonating club officers to request gift cards or urgent bank transfers).

Suggested Remediation

1. Require Authentication for Lookups: Restrict client-side name auto-complete and drop-down suggestions strictly to authenticated (logged-in) user sessions.
2. Require Exact Inputs for Logins: Require unauthenticated users logging in to enter their exact registered username or email address, rather than dynamically querying and returning matching member names over public endpoints.

Thank you for reviewing this report and for your ongoing work supporting Toastmasters clubs globally.

Kind regards,

Graeme Dunlop
Technology Manager, Toastmasters District 73