3 ms·
> - Don't show "That email address was not found" when someone tries to recover a password. You are giving out too much info, which can be used maliciously. Do
by sbov 16y ago
> - Don't show "That email address was not found" when someone tries to recover a password. You are giving out too much info, which can be used maliciously.
Does this really matter if a site only allows 1 registered user per email address? I can farm this information by trying to sign up a new account.
- csomar 16y agobut when signing up there is a captcha, unlike the login page.(Okay, unless it's AJAX).
- sbov 16y agoMost websites out there don't actually require a captcha for signup. Paypal certainly doesn't. (I'm not going to create a fake wepay account to check if/when they do email uniqueness validation.)
- sophacles 16y agoEven if this is true[1], it never hurts to consciously limit the places where information flows out of your system. The idea is that securing one point is easier than securing n points. [1] I don't doubt the flow of information, but the rate at which that information can be leaked through a signup page can be severely limited compared to a password recovery page.