3 ms·

Registration, login, or password reset flows commonly leak directly or indirectly (eg via a timing channel) whether a user exists or not.