News for hackers. Stuff that matters.
Re:Innovation Nation: WePay is the anti-PayPal by sbov on Tuesday October 12, 2010 @06:43PM (#1785280)
> - Don't show "That email address was not found" when someone tries to recover a password. You are giving out too much info, which can be used maliciously.

Does this really matter if a site only allows 1 registered user per email address? I can farm this information by trying to sign up a new account.

Re:Innovation Nation: WePay is the anti-PayPal by sophacles on Wednesday October 13, 2010 @09:39AM (#1787016)
Even if this is true[1], it never hurts to consciously limit the places where information flows out of your system. The idea is that securing one point is easier than securing n points.

[1] I don't doubt the flow of information, but the rate at which that information can be leaked through a signup page can be severely limited compared to a password recovery page.

Re:Innovation Nation: WePay is the anti-PayPal by csomar on Tuesday October 12, 2010 @06:51PM (#1785317)
but when signing up there is a captcha, unlike the login page.(Okay, unless it's AJAX).
Re:Innovation Nation: WePay is the anti-PayPal by sbov on Tuesday October 12, 2010 @07:29PM (#1785410)
Most websites out there don't actually require a captcha for signup. Paypal certainly doesn't. (I'm not going to create a fake wepay account to check if/when they do email uniqueness validation.)