Re:Password-less login
by zbuf on Friday March 10, 2017 @07:19AM
(#13838023)
You can easily leak whether someone has an account on your website -- if I know their email address and input it, does it basically tell me? This limits your ability to reasonably error if the email address inputted is wrong.
Still, a lot of "forgot password" forms seem to be subject to this, too.
Also, you can only have one account per-email -- a disadvantage for some types of service, but admittedly probably a good thing for most.
Still, a lot of "forgot password" forms seem to be subject to this, too.
Also, you can only have one account per-email -- a disadvantage for some types of service, but admittedly probably a good thing for most.