3 ms·
Signup forms should never leak "email/username does not exist" but only "this combination of email/username and password is unknown". Can you explain this to m
by mootothemax 14y ago
Signup forms should never leak "email/username does not exist" but only "this combination of email/username and password is unknown".
Can you explain this to me? Is the only difference the error message used, or are you suggesting that apps should support multiple accounts with the same email/username but with different passwords? Or something else entirely? :)
Personally, I don't understand what difference a message makes; it'd be trivial for a user to test by signing up for an account themselves. And not having a unique login identifier would be a nightmare. Which makes me think I'm missing something obvious (damn this headcold, it makes me feel so much more stupid than usual!).
- Xylakant 14y agoI'm sorry, my mistake here. I was thinking login forms. But the same thing can be done with signup forms, as explained in the response to the comment following yours.