Instead of deleting account, NYT appends ‘1000’ to username and email address

Re:Instead of deleting account, NYT appends ‘1000’ to userna... by ecnahc515 on Tuesday April 28, 2020 @04:44PM (#23011743)

As others have mentioned, that's an issue already. The solution is to never acknowledge if a user does or doesn't exist on register/sign-up/forgot-password pages and simply state that instructions have been emailed to you in all cases. The key is that you don't act differently if the user does or doesn't exist.

[ Parent | on HN ]

Re:Instead of deleting account, NYT appends ‘1000’ to userna... by cutemonster on Wednesday April 29, 2020 @06:38PM (#23025385)

If they don't get a verification / instructions email, they'll know an account with the username they typed, existed?

[ Parent | on HN ]

Re:Instead of deleting account, NYT appends ‘1000’ to userna... by ecnahc515 on Tuesday May 12, 2020 @07:46PM (#23161541)

In this case, where you're probing for user names or emails, you don't own the email, so you wouldn't receive the verification yourself, and thus wouldn't know if the account exists.

This is exactly why most password reset emails say "if you didn't request this, please let us know, as someone may be attempting to access your account".

[ Parent | on HN ]

Re:Instead of deleting account, NYT appends ‘1000’ to userna... by lytefm on Friday May 01, 2020 @09:32AM (#23041791)

You shouldn't use usernames in that scenario, just emails. After Signup, you just show a general message that a confirmation Email has been sent. If the account already exists, some policy to notify the account owner can be put in place.

[ Parent | on HN ]