> - Don't show "That email address was not found" when someone tries to recover a password. You are giving out too much info, which can be used maliciously.
Does this really matter if a site only allows 1 registered user per email address? I can farm this information by trying to sign up a new account.
Even if this is true[1], it never hurts to consciously limit the places where information flows out of your system. The idea is that securing one point is easier than securing n points.
[1] I don't doubt the flow of information, but the rate at which that information can be leaked through a signup page can be severely limited compared to a password recovery page.
Most websites out there don't actually require a captcha for signup. Paypal certainly doesn't. (I'm not going to create a fake wepay account to check if/when they do email uniqueness validation.)
Does this really matter if a site only allows 1 registered user per email address? I can farm this information by trying to sign up a new account.