I am just wondering your opinions on why it would/would not be a good idea to mask or obfuscate email address data in a password reset web submission once the user has entered their username informing them of where the password reset link was sent to.
"Your password reset link has been sent to Mar************lky@h******.com If this isn't your address please contact us on 1-800-555-5555."
Large providers, such as Apple and Google, do this to an extent, and I believe it helps users remember what address they set, if they rarely use the service and provides them an opportunity to realize "oh cr@p, I have that old address still!".
Thoughts for pro's and cons would be most welcome!