News for hackers. Stuff that matters.
Re:Password-less login by zbuf on Friday March 10, 2017 @07:19AM (#13838023)
You can easily leak whether someone has an account on your website -- if I know their email address and input it, does it basically tell me? This limits your ability to reasonably error if the email address inputted is wrong.

Still, a lot of "forgot password" forms seem to be subject to this, too.

Also, you can only have one account per-email -- a disadvantage for some types of service, but admittedly probably a good thing for most.

There are no comments on this comment yet.