4 ms·
There's a major problem with this: privacy. The password process needs to prevent against discovering that someone else has an account. The way to do this is to
by xofer 13y ago
There's a major problem with this: privacy. The password process needs to prevent against discovering that someone else has an account. The way to do this is to respond exactly the same way whether the account exists or not. Less user friendly, yes.
- ComputerGuru 13y agoI used to say the same, and was a staunch advocate of that. However, it was pointed out to me that virtually every. single. website. that does this still leaks that self-same info during registration: i.e. what do you do on your site to prevent "existing account discovery" when someone tries to sign up with an email address that one of your users already has?
- xofer 13y agoLet an existing user register as a new user, send an activation email and update the account with the new info (if changed) if they re-activate.