3 ms·

I would think the bigger time difference would come from sending an e-mail message (or not), not the database look-up itself. But I'm still not convinced that'

by sltkr 14y ago

I would think the bigger time difference would come from sending an e-mail message (or not), not the database look-up itself. But I'm still not convinced that's easily measurable in practice, considering most sendmail implementations dump messages into a queue rather than trying to deliver them immediately.

Xylakant 14y ago
But that's the whole point: You send an email in any case to the given email address. If the address is registered, you send a "this is you password reset link" email and if not you send a "ok, somebody requested a password reset for this email-address and we don't know it" email. This sort of reduces pain point 3) as well since you can offer some explanation to the user [1] but I guess there's always someone who doesn't get it, so it's not a complete solution to that problem. [1] "If you're registered here, you might be registered with a different email address. If you're not, ignore this one. etc."