4 ms·
I’ve seen this obfuscated by some systems by always just throwing the user a message saying the reset email has been sent so that there’s no indication whether
by 52-6F-62 6y ago
I’ve seen this obfuscated by some systems by always just throwing the user a message saying the reset email has been sent so that there’s no indication whether or not the email is associated with an account or not.
Of course, that doesn’t help someone who can’t remember if they’d signed up or not but it’s probably the safer way to go in general.
- awinter-py 6y agoyup, need to do it in the signup case as well but it solves the problem
- contravariant 6y agoThere's typically a system that forbids you from adding an additional account with the same email though.