Forgot password and revealing whether account exists

Question

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets;

• Notify the user whether or not the email address matched with one in the database and based on this advise whether a reset password email was set or;
• Immediately respond with a "Email sent" or "If this user exists, we have sent you a password reset email" regardless of whether or a match occurred resulting in an email sent. This is done (apparently) for security reasons.

I've implemented the latter myself and generally found it raised annoyance with users due to;

1. If a user mistypes their email address, they are told an email is sent, but they will never receive one.
2. If they've typed in a different email address than the one they registered with, again they won't be getting an email.
3. A combination of the above can result in multiple attempts but no receipt of a password reset email, resulting in giving up.

Finally, upon investigation of popular websites that use the second scenario, I've found that attempting to register an account with these sites where the entered email address matches an existing account, a "this email address is already in use, or unavailable" type message is displayed anyways.

As such, what are the benefits not revealing whether a password reset email has matched an account?

Answer 1

I think this is generally on the wrong side of being unhelpful to legitimate users of legitimate sites - but if your site was promoting anonymity, telling a random web user if a particular email address was valid would be a leak.

Answer 2

Sites where the privacy of the users are more important, If a user tries login with the email and a wrong password, its better not let him know whether the email exist or not.just let him know its wrong and could ask to enter password with mobile number/username.

Answer

It is to respect the privacy of the already existing users. Else others will be able to know whether a user is registered or not

Answer 3

Depending how easy it is to sign up to your site you may not be leaking info by telling whether email was sent or not.

If anyone can create an account it will probably tell if email is in use or not. So at the end of the day the extra annoyance isn't buying you any extra security.

What you should not leak is the emails if users can supply either username or email. It would decrease security if you told the user which email the token was sent to since that could be used to get the email from users if those are not public.

Answer 4

It is worth considering that revealing the information of whether the holder of a specific email address has an account at your site may be illegal in some jurisdictions. For instance, here in the UK, you should obtain the user's consent before revealing this information.

One work around would be to ask for some lower security information, eg date of birth, mother's maiden name, etc as part of the process, before revealing whether the account exists.

Answer 5

Your point about trying to register and getting a 'this email address is already in use, or unavailable' message is interesting and seems to be a more important point to consider than whether or not to let people know the forgot password email was sent. They seem to go hand in hand.

If you are willing to display the fact that an email is already in use and can't be used in an account, of course let people know if the forgot-password email was sent.

But if your site demands anonymity, you can't require Unique emails & prevent people from trying to use one that is already in use. Instead, just require verification of the email and by default only the real owner will be able to use it. You could even block them out of any other account activity until the email is verified.

Answer 6

For my opinion, on the reset form, we don't tell wether the email is valid or not. We only show that the reset process is sent to the submitted email. Then, the content of the email is either an invalid-email message or a reset link.

However, this technique may be annoying if someone use this reset form to spam someone else's email. Some prevention mechanisms reqired, like limit the number of submission.