Even if the password-rest-page doesn't leak information about which e-mail addresses have accounts associated with them, the register-new-account-page usually d

Even if the password-rest-page doesn't leak information about which e-mail addresses have accounts associated with them, the register-new-account-page usually does. Of course websites could work around this by sending an e-mail message to the address to confirm ownership first, but this is rarely done in practice. An easier fix is for users to randomize the email-addresses they use. For example, if you have a Google Mail account, you can receive messages at username+randomdata@gmail.com; if you use different random data for each site, nobody will able to probe for your account as described in the article, even on poorly-designed websites. The advantage of this approach is that it's something that privacy-minded users can do themselves, without having to rely on website developers to get things right.