3 ms·

In the GitHub case the handles are public information. Anyone can go to https://github.com/<handle> https://github.com/<handle> to verify if it exists. So they

• tantanel 9y ago
  This is true for the username but it's possible to make your email address private on GitHub in which case the message that your email is taken can still be considered an information leak.
  • jwilk 9y ago
    You can check if an e-mail is associated with a GitHub account easily. You forge a commit with this email as author email, push it to a foo/bar repo, then look at https://github.com/foo/bar/commits/master https://github.com/foo/bar/commits/master .
• _asummers 9y ago
  But to you -- the user entering credentials -- that error message is still accurate. From GitHub's perspective, they don't know which one you entered correctly. It could be argued they should tell you that the username doesn't exist if it doesn't (reasonable with public profile), but in the case of an existing user, this is the only correct error message.