News for hackers. Stuff that matters.

A comment on Database leak exposes 3.3M Hello Kitty fans. Parent comment

Re:Database leak exposes 3.3M Hello Kitty fans by dthakur on Tuesday December 22, 2015 @01:49PM (#10779504)
If there are other ways to confirm whether a user exists or not (signup email check for example) --

I would add that the 'bonus' of not informing of the correct error provides minimal security gain and hurts usability.

[ Parent | on HN ]
Re:Database leak exposes 3.3M Hello Kitty fans by nly on Tuesday December 22, 2015 @07:26PM (#10781283)
> If there are other ways to confirm whether a user exists or not (signup email check for example) --

This would be a bug. There should be no way for someone with my e-mail address to determine if I use any particular service.

[ Parent | on HN ]