Skip to main content
4 of 4
deleted 86 characters in body
Joseph
  • 2k
  • 3
  • 15
  • 23

In the first case (I get a message telling the email is not recognized), it's a security concern. One can brute-force the form with a list of emails and know which of them are in the system indirectly. Given the same list of emails, and a bunch of sites whose forms act in the same way, you can correlate, and infer user behavior. That's not good for privacy. That's why password reset forms nowadays will "always "succeed" regardless of the presence of the email in the system to avoid this.

The second case (I get a message telling me that if that email is registered, it will receive a password link) is a security feature. A reset email acts as a confirmation whether or not the owner initiated a reset by sending the next phase of the reset to a location only the owner knows. This assumes that the email wasn't compromised as well.

Well, why not just sign me up when I do that?

It only makes sense when the email isn't in the system. Why would you show a signup form with an email that's already used? This also means that form will have to make a determination when to show a sign up form based on the existence of the email. This makes it no different from the first case mentioned above.

Joseph
  • 2k
  • 3
  • 15
  • 23