5 ms·

That's the point of the article though - for a large percentage of services, if you know the username/email address you are targeting, you can just try to regis

That's the point of the article though - for a large percentage of services, if you know the username/email address you are targeting, you can just try to register them and see if it works. Obfuscating the login process makes little difference.

testvox 9y ago
Which is why they shouldn't leak this information on the registration page... Instead they should pretend the registration always succeeds and then disallow login until the email has been verified.
- ocfx 9y ago
  Which is back to bad UX.
- gozur88 9y ago
  That works for the email, but not the user name. Going through the entire process and then telling the new user "That one's already taken, please start over" is not going to make people happy.