Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Some applications tend to hide completely the user associated email address or just showing a part of it (e.g. f***[email protected]) in the user's personal settings. Other applications don't mind showing the full email address.
What are the security implications of knowing the email address of a possible compromised account? Why some applications hide it, especially in username and password based authentication?
One compromised account should be enough leverage to compromise others. The user knows their own email addressed; they just need a reminder of which one they used in the account.
Knowing the email address means that the attacker can use info from the compromised account to phish the victim with something specific.
