4 ms·
If you're only giving the message when the username doesn't exist, wouldn't that mean the attacker would know when the username does exist?
by higherpurpose 12y ago
If you're only giving the message when the username doesn't exist, wouldn't that mean the attacker would know when the username does exist?
- wtetzner 12y agoThe message is always sent through email though, so the attacker wouldn't see it.