Timeline for What's the reason behind not notifying users that they entered a wrong email when they recover their password?
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 31, 2017 at 16:38 | comment | added | Nathan Christie | The point about easier targets is important. Malicious users are still users. Each layer of inconvenience, no matter how trivial, reduces conversions -- in this case, fraud. By the same token, there is no silver bullet - you will likely never prevent fraud outright, but you can under ideal circumstances reduce the incidence and impact to trivial scales. | |
| Jul 31, 2017 at 8:52 | comment | added | Nils Q. | @GypsySpellweaver That's an interesting idea. I also forgot that most websites use some captcha when you register an account, that might get triggered when you try to spam many different email addresses, which might provide some additional security against such attacks | |
| Jul 31, 2017 at 4:54 | comment | added | user102492 | @NilsQ. Not that it is that much more work, but the second option does take a bit more time to check into. A state actor might be willing to do the extra work, most other malicious actors will, however, move to easier targets. | |
| Jul 30, 2017 at 17:44 | comment | added | Mike M | Ah, true. Good point | |
| Jul 30, 2017 at 17:44 | history | edited | Mike M | CC BY-SA 3.0 |
added 335 characters in body
|
| Jul 30, 2017 at 17:43 | comment | added | Nils Q. | Correct, but an attacker can gain this information anyway when they try to register an account with the address. Therefore, this step does not increase the privacy but creates additional inconvenience. | |
| Jul 30, 2017 at 17:37 | history | answered | Mike M | CC BY-SA 3.0 |