Re:Smart Enough Not To Build This Website
by mojuba on Thursday June 26, 2008 @08:31AM
(#228506)
The vast majority of web sites have this privacy/security flaw in their password recovery systems: they respond by saying if they have the email address or not in the database, which means, anyone can check out if you are a member of a service or not by trying out your email.
[ Parent
| on HN ]
I've done it both ways and the customer service reps much prefer when it lets you know if the email was sent or not. Otherwise they get lots of calls from unhappy people who put in their old email address and didn't get their login info. It's a usability trade off.
I think a good compromise is limiting to a few attempts within a time period. That way you won't get a dictionary attack, but if someone has to try a few email addresses they can.