4 ms·

If there are other ways to confirm whether a user exists or not (signup email check for example) -- I would add that the 'bonus' of not informing of the correc

by dthakur 11y ago

If there are other ways to confirm whether a user exists or not (signup email check for example) -- I would add that the 'bonus' of not informing of the correct error provides minimal security gain and hurts usability.

nly 11y ago
> If there are other ways to confirm whether a user exists or not (signup email check for example) -- This would be a bug. There should be no way for someone with my e-mail address to determine if I use any particular service.