I used to think this as well. BUT, revealing _any_ information to attacker is a security problem. Take this scenario: Someone might not want their employer kno

I used to think this as well. BUT, revealing _any_ information to attacker is a security problem. Take this scenario: Someone might not want their employer knowing they (legally) gamble online. The employer could simply browse to popular online gambling sites and probe the service with their email or username to see if an account exists.