3 ms·
It's a solved problems that you never confirm or deny the registration of an identity (like email or phone) for your service. Bad login? "Not a valid user/pass
by unethical_ban 4y ago
It's a solved problems that you never confirm or deny the registration of an identity (like email or phone) for your service.
Bad login? "Not a valid user/pass combo"
Password recovery? No matter what email or phone provided, simply say "If the email matches our records, we will send a recovery link".
- brabel 4y agoUntil the UX team comes in and demands "better error messages".
- unethical_ban 4y agoPossibly, but a good org will empower security teams to make that call and collaborate with UX on a safe compromise.
- DharmaPolice 4y agoWhat about new user sign up? Most systems will tell you if an email address has already been registered (and it seems hard to get round that).
- vinay_ys 4y agoYou can always show that message after email is verified. Don't reveal information without verifying the ownership of email or phone number.