3 ms·
Don't allow users to determine whether an email address is registered in your system. (Even if they click "forgot password" or "send money request"). More impo
by krallja 13y ago
Don't allow users to determine whether an email address is registered in your system. (Even if they click "forgot password" or "send money request").
More importantly, don't ever give the user the full name of someone whose email address they pulled out of thin air!
- nbody 13y agoSeems viable, and if you had previous "relationship"/transaction with this user you can display name etc.