Timeline for Does correcting misspelled usernames create a security risk?
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 10, 2016 at 14:31 | comment | added | Neil Smithline | @TTT - It's not that email iteration is less of an issue, it is just that preventing email iteration is basically impossible. For Facebook, any list of personal emails is a pretty good list of Facebook email addresses. While iteration is still a problem, it's not something they can really protect against. So Facebook makes different decisions when weighing user-friendly options v. security to prevent email iteration because they've already lost the email iteration battle. | |
| May 10, 2016 at 14:27 | comment | added | TTT | I'm not sure I follow your first paragraph. Why would having a large base of users make "email iteration" less of a security issue? The method they use to determine whether email iteration should be done (e.g. did you log in from this browser or computer before), could also be done by smaller sites, couldn't it? And if so wouldn't it be equally as secure? | |
| May 10, 2016 at 14:21 | comment | added | TTT | Based on Lukas' answer, your assumption in the 2nd paragraph appears to be correct. | |
| May 10, 2016 at 14:10 | history | answered | Neil Smithline | CC BY-SA 3.0 |