Comment by smackfu
14 years ago
Doesn't really matter, the password reset page leaks the same info and has presumably been up forever:
There is no account registered to mail 'abc@smackfu.com'.
And that's a lot harder to fix.
14 years ago
Doesn't really matter, the password reset page leaks the same info and has presumably been up forever:
There is no account registered to mail 'abc@smackfu.com'.
And that's a lot harder to fix.
Why is that harder to fix? Many sites handle it properly:
"If there was an account associated with that email address we have emailed it with instructions."
Since people log in with a username, not an email, they may not know which email address they associated with the account. Especially if they used a one-off to avoid spam. Personally, I prefer systems that do a reset to email after you provide a username, since usernames are often public / verifiable anyways.