3 ms·
Yes. The proper way to implement this flow is to ask for the information, and then present the exact same result screen regardless of the actions taken. Any a
by jdmichal 4y ago
Yes. The proper way to implement this flow is to ask for the information, and then present the exact same result screen regardless of the actions taken. Any additional information or action should be done exclusively through the contact information you have on record.
- pyrolistical 4y agoAnd making sure constant time on the response. Otherwise the slower response likely corresponds to a real phone number if the backend synchronously did more actions, such as sending a recovery email. The backend would need to be really slow however in order for a strong enough signal for this to be useful.
- klysm 4y agoStill it’s so much better to have the binary information of whether or not an account exists with that information than exactly which account it is.
- nishs 4y agoNo, the binary information too is a privacy concern. For example, one could enter a coworker's phone number to confirm that the coworker has a 4chan account. This isn't good.