3 ms·
> The problem with this argument IMHO is that a lot of sites take a policy of not revealing if an account exists or not. They don't, really. Because they have
by runeks 3y ago
> The problem with this argument IMHO is that a lot of sites take a policy of not revealing if an account exists or not.
They don't, really. Because they have to prevent me from registering an account with the same identifier (username/email) as someone else, thus revealing whether an account exists or not. So the fact that the password recovery page doesn't reveal it makes no difference for someone who wants to know.
- dwaite 3y agoSome sites can do this by going as far as to say they've sent the activation email, then instead sending an email saying that there seems to be a registration attempt against their existing account. How useful this sort of hiding is in practice is somewhat debatable. Github, forums, marketplaces and social networks all tend to have profile pages. I'm more likely to promote these as part of my public-facing persona as well. The problem in this context I believe - if the largest sites on the internet think they need to protect information about valid accounts, most people will have passkey "slots" on a limited-storage key fob taken up by those sites.