Email enumeration vulnerability on "Password Reset" dialogue

Simply… people are bad at remembering which email address they used to create an account, and will contact admins to troubleshoot.

This is similar to enforce second factor or min password length — I think the general recommendation is to always require a second factor, and password minimum length recommendations now seem to be higher than our current default for regular users… but there’s also a gap between security recommendations and average computer skills.

I’m not strongly against changing the defaults, but it’s worth noting that they can impact usability.

11 Likes