Password reset confirm message should discourage social engineering

If you want this, enable it in site settings. Already exists.

By default we tell people since they can never remember which of their 10 email addresses they signed up with, so it is user hostile to force them to walk through all 10 emails to figure out which one they used on your site.

5 个赞