> attempting to deduplicate email addresses before authentication is almost as bad as lowercasing the password before checking if it matches. I think it's not

> attempting to deduplicate email addresses before authentication is almost as bad as lowercasing the password before checking if it matches. I think it's not even close. You have to transmit the content of the email address to the server, since you might need to email the person. Whether you validate/sanitize/perform voodoo on it there is up to you. You don't have to transmit the password (because one way hashing), and should never do so.