Timeline for What's the reason behind not notifying users that they entered a wrong email when they recover their password?
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 4, 2017 at 13:25 | vote | accept | Nils Q. | ||
| Aug 3, 2017 at 14:52 | comment | added | Alan | To add to this answer, I'm guessing they (sites like DropBox) prevent this on the reset password page and not the registration page because that's where malicious users will look to first. | |
| Jul 31, 2017 at 8:50 | comment | added | Nils Q. | This blog post is very interesting to read, thx! What do you think about something like rate-limiting, i.e., we can't let a possible attacker spam thousands of addresses or do not give any informations about whether this account exist or not after let's say 3 wrong attempts? However, using the registration process for such an "attack" might be not feasible since users often have to enter some captacha before submitting the form, this might be an approach for the password reset process as well. | |
| Jul 30, 2017 at 21:39 | history | answered | Drown | CC BY-SA 3.0 |