1

Should the user be told if they enter an email which is not in the database?

  1. User forgets their password and clicks a link to reset it.
  2. Page displays "An email was just sent out to youremail@bla.com with instructions to reset your password".
  3. User doesn't know this, but the server checks if the email exists in the DB, and if so, sends out the email
  4. User receives an email with a link with expiration to reset their password.
  5. User clicks link and is sent to a form to set their password.

OR MAYBE

  1. User forgets their username and clicks a link to get it.
  2. Page displays "An email was just sent out to youremail@bla.com with your username".
  3. User doesn't know this, but the server checks if the email exists in the DB, and if so, sends out the email
  4. User receives an email with their username.
5

The law in the EU states that a service provider should not disclose ANY information on an individual without an explicit consent from that individual.

Whether or not one is a member of a particular site falls into 'ANY information'.

As such, a website should not tell anyone whether the email address exists is in the database or not - doing so will reveal whether an individual is a member of that site. An email address is a unique identifier of a person and in some cases it can be easily obtained; for instance, if one has registered a co.uk domain.

Another important example is people normally know the email address of their partner, and would love to know whether he or she is a member of a dating or a porn site.

A cartoon

Whether in the EU or not, this is a privacy concern any service provider should account for.

  • Do you have recommendations for what to say without revealing whether the email exists or not? – Garry May 14 '15 at 6:14
  • @Garry "Email send, follow the instructions". - And then either just not send an email, or tell in the email that no account existed. – paul23 May 23 at 19:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.