Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> - Don't show "That email address was not found" when someone tries to recover a password. You are giving out too much info, which can be used maliciously.

Does this really matter if a site only allows 1 registered user per email address? I can farm this information by trying to sign up a new account.



Even if this is true[1], it never hurts to consciously limit the places where information flows out of your system. The idea is that securing one point is easier than securing n points.

[1] I don't doubt the flow of information, but the rate at which that information can be leaked through a signup page can be severely limited compared to a password recovery page.


but when signing up there is a captcha, unlike the login page.(Okay, unless it's AJAX).


Most websites out there don't actually require a captcha for signup. Paypal certainly doesn't. (I'm not going to create a fake wepay account to check if/when they do email uniqueness validation.)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: