Privacy

Reduce Account Enumeration with Consistent Authentication Responses

A login form can reject every incorrect password and still reveal useful information about its users. If the application says Account not found for one email address and Wrong password for another, anyone who can submit login attempts can learn which address belongs to an account. That information leak is called account enumeration. The same problem can appear in password-reset, registration, invitation, and account-recovery flows. Even when the visible message is identical, differences in HTTP responses, redirects, response size, or processing time can reveal the same fact.