If the signup or reset process enables user enumeration, we tend to ding you on that in audits the same way we ding you for enumeration via the login form. Cap

If the signup or reset process enables user enumeration, we tend to ding you on that in audits the same way we ding you for enumeration via the login form. Captchas, timeouts and rate limits are all well and good, but given the attack tools (eg: SentryMBA, OpenBullet) used by the lowest common denominator solve for those (by using captcha API's and residential proxy networks)... Breaking user enumeration vectors becomes super useful.