Some applications tend to hide completely the user associated email address or just showing a part of it (e.g. f***o@foo.com) in the user's personal settings. Other applications don't mind showing the full email address.

What are the security implications of knowing the email address of a possible compromised account? Why some applications hide it, especially in username and password based authentication?

  • Its just another piece of information,that you will use to piece together and further copromise the user.
    – yeah_well
    Mar 24 at 9:03

One compromised account should be enough leverage to compromise others. The user knows their own email addressed; they just need a reminder of which one they used in the account.

Knowing the email address means that the attacker can use info from the compromised account to phish the victim with something specific.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.