https://nalar.dev/tags/privacy/ Recent content in Privacy on Nalar Hugo en-us Fri, 04 Sep 2026 00:00:00 +0700 https://nalar.dev/reduce-account-enumeration-with-consistent-authentication-responses/ Fri, 04 Sep 2026 00:00:00 +0700 https://nalar.dev/reduce-account-enumeration-with-consistent-authentication-responses/ <p>A login form can reject every incorrect password and still reveal useful information about its users. If the application says <code>Account not found</code> for one email address and <code>Wrong password</code> for another, anyone who can submit login attempts can learn which address belongs to an account.</p> <p>That information leak is called <strong>account enumeration</strong>. The same problem can appear in password-reset, registration, invitation, and account-recovery flows. Even when the visible message is identical, differences in HTTP responses, redirects, response size, or processing time can reveal the same fact.</p>