Timeline for Why enter again (or at the very least confirm) my email address when I click "Forgot password"?
Current License: CC BY-SA 3.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 20, 2015 at 14:32 | comment | added | Chris Murray | Similarly this can be used to discover if an email address has been registered with a site; but this can be gotten around by changing the message to something like "If the email address is registered with us, a reset password link has been sent". | |
| Aug 20, 2015 at 9:24 | comment | added | Vinko Vrsalovic | I was thinking about sites where your is your email so there's no information disclosure risk. But that's correct, if users are not emails then that's a real risk you could mitigate by saying instead "an email has been sent to your registered address" | |
| Aug 20, 2015 at 9:22 | history | answered | BadSkillz | CC BY-SA 3.0 |