3 ms·
true, but most of those sites have a separate field for "display name". No one want's their email address to be tagged on each post. :)
by Tagbert 4y ago
true, but most of those sites have a separate field for "display name". No one want's their email address to be tagged on each post. :)
- zeven7 4y agoYou can still often check to see if someone has an account for a service by just .. trying to sign in or retrieve lost password. You often don't need to have the password or access to the email to tell from the response if there's already an account registered for that email address.
- hunter2_ 4y agoThat's a valid argument if your threat model only involves other visitors who aren't given access to see email addresses, but it breaks down if you're hiding from the site administrators, an attacker who obtains admin access, and whomever the attacker makes the data available to.