Live data from Hacker News

Why forgotten password forms shouldn't tell you when the email doesn't exist

busted-app.herokuapp.com

1–2 of 2 posts

Re: Why forgotten password forms shouldn't tell you when the email doesn't exist

#2
Indeed.

Imagine a similar page to this that searched a whole bunch of NSFW sites doing the same trick - and then a site that feed your whole address book through them.

Imagine HR depts routinely feeding applicant's emails into such a system.

Hard to imagine that someone isn't already doing this sort of thing...