# Different password reset for wrong username/email
**URL:** https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909
**Category:** Feature
**Created:** [May 23, 2014, 2:16pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909 "2014-05-23T14:16:30Z")
**Posts on this page:** 20
**Page:** 3
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 16, 2015, 11:35pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/41 "2015-03-16T23:35:59Z")
> [@dustinmoris](#):
>
> Anyway, I wanted to raise awareness of this problem, but after all it is your product and you choose if you target only a specific audience or if you want to make it most usable for everyone.
Make sure you also tell Tumblr, Facebook, and Twitter about their vulnerability too. đ
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [March 17, 2015, 2:45am UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/42 "2015-03-17T02:45:41Z")
> [@dustinmoris](#):
>
> Look, I donât think there is a golden solution for everyone. Every product is different and requirements might be different.
Exactly why we have the option in site settings. Itâs quite reasonable to expect a site administrator to review login settings.
Also, the default isnât an exposure. All it says is that _someone_ created an account with that email. It could be an unverified, never-logged in email.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [March 17, 2015, 2:49am UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/43 "2015-03-17T02:49:44Z")
My point here is very simple, show me one popular website on the entire Internet that follows a strict no-emails-can-ever-be-disclosed policy.
---
### Author:  [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [March 17, 2015, 2:57am UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/44 "2015-03-17T02:57:51Z")
Years ago I missed a renewal payment to my site host.
When I tried to login to the ACP I got an
âInvalid Loginâ message.
I carefully checked my spelling and case but several repeat attempts continued to fail.
Much confused I eventually called support and was told the reason was because of a lapse in payment.
It didnât make sense to me at the time how this could be considered an invalid login.
But after thinking about it, it kinda sorta did.
IMHO I would prefer a generic non-specific message, but as long as there is a configurable option I donât see there being a problem for like minded Admins.
---
### Author:  [@elberet](https://meta.discourse.org/u/elberet)
#### Post date: [March 17, 2015, 12:02pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/45 "2015-03-17T12:02:14Z")
Wasnât Discourseâs mission statement to not follow the trodden path and finding better ways to do things? đ
_AnyhowâŚ_
@dustinmoris raises a valid issue, but itâs based on the assumption that Discourse will be used heavily on sites where merely exposing the fact that you are a member is a critical privacy concern. Such sites do exist without a doubt, but they are a minority and perhaps Discourse just isnât the right platform for them â _yet_.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [March 18, 2015, 4:50am UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/46 "2015-03-18T04:50:08Z")
My point here is that this setting has nothing much to do with the root problem that there is email disclosure when you register accounts. Nobody ever complained about this before and its a very common practice. In fact it is so common I have never seen a modern website that does not have this âvulnerabilityâ
The behavior of âsilentlyâ allowing people to register accounts with incorrect/already registered emails and just doing nothing at the end of the process is odd and not something that should be a default.
For the super privacy conscious there are already 3 super common solutions
1. Donât give third party sites your email address, use throw away accounts
2. Use gmail + addressing eg: [sam.saffron+someguid@gmail.com](mailto:sam.saffron+someguid@gmail.com)
3. Site operators can implement SSO and use whatever crazy auth system they want
4. If someone wants to work through a âenable\_tin\_foil\_hatâ site setting I am open to it, but the core team are not going to work on this until a paying customer asks for it
---
### Author:  [@elberet](https://meta.discourse.org/u/elberet)
#### Post date: [March 18, 2015, 5:12am UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/47 "2015-03-18T05:12:39Z")
Oh I think you got that point across quite well, but the whole discussion here got _ **super** _ intense super quickly, and weâre suddenly spending more time on bickering than on thinking about if and how something useful could come from all this. And thatâs a shame. đ
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [March 18, 2015, 5:33am UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/48 "2015-03-18T05:33:58Z")
It got intense cause a brand new user told us we are ânarrow mindedâ and âdiscriminatoryâ
Then the same new user said that site settings do not matter cause âno one will ever user itâ
It just struck a huge nerve with me and made me super upset.
I felt like a condensending disappointed adult decended upon us to teach us the errors of our way. We agonized quite a lot about these defaults you know.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 19, 2015, 11:17pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/49 "2015-03-19T23:17:57Z")
> [@supermathie](#):
>
> All it says is that someone created an account with that email. It could be an unverified, never-logged in email.
Not quite, we deleted unverified accounts after 7 days.
I donât think anything useful can come of a âno email shall ever be disclosed, even upon account signupâ discussion @elberet. I mean, can you really point to _any_ other site on the Internet that works this way??
---
### Author:  [@elberet](https://meta.discourse.org/u/elberet)
#### Post date: [March 19, 2015, 11:35pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/50 "2015-03-19T23:35:37Z")
Off the top of my head? Nope. But Iâve read some news the other day about an open source project thatâs intended to drive whistleblower sites⌠I didnât check it out (or read past the articleâs blurb), but not disclosing the usersâ email addresses might be a pretty big deal there.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [March 19, 2015, 11:48pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/51 "2015-03-19T23:48:20Z")
I am fine with adding a mode like this, but someone else is going to have to work on it, it would actually be nice to get rid of `forgot password strict` and replace with an encompassing term that defines a âemail never disclosed but registrations can be a bit of a pain in the assâ mode.
---
### Author:  [@michaeld](https://meta.discourse.org/u/michaeld)
#### Post date: [June 29, 2017, 3:29pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/52 "2017-06-29T15:29:04Z")
> [@sam](#):
>
> We aleady do something similar, point being, letting people go through the entire registration system without revealing they already have an account is insane and something I have never seen in the wild.
Me neither, until now. I just signed up (again, by accident) at Hipchat, and instead of the confirmation email they promised, I got this:
> Hi \*\*\*\*\*,
>
> It looks like youâve tried to create an Atlassian account for \*\*\*\*\* @ \*\*\*\*\*.
> However, an account for that email address already exists.
>
> You can reset your password if youâve forgotten it.
> If you didnât try to create an account for \*\*\*\*\* @ \*\*\*\*\*, donât worry - we havenât done anything, and you can safely ignore this message.
> Feel free to contact us if youâve got any questions.
>
> Cheers,
> The Atlassians
This would be a pretty neat feature for Discourse if you ask me!
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [June 29, 2017, 7:55pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/53 "2017-06-29T19:55:27Z")
Er.. what? That feature already exists
We could make this a bit easier by jumping them over to âreset passwordâ at that point, I guess, but feels like a bit of a micro-optimization cc @neil
---
### Author:  [@michaeld](https://meta.discourse.org/u/michaeld)
#### Post date: [June 29, 2017, 8:36pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/54 "2017-06-29T20:36:51Z")
No..?. this is the opposite⌠itâs about never saying âemail has been takenâ and instead making it impossible to misuse the sign up process to see if there is an account using a specific e-mail address. Atlassian only discloses that in the âconfirmationâ email that is sent, not in the web interface.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [June 29, 2017, 8:39pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/55 "2017-06-29T20:39:14Z")
I see, so the disclosure is only via email, not in the UI. Well, there is an existing site setting to disable the UI disclosure, of course, and thatâs _off by default_ ⌠but there is no direct email response handling.
It seems to me the direct email only makes sense in the context of zero UI disclosure, though. Which is not our default.
---
### Author:  [@michaeld](https://meta.discourse.org/u/michaeld)
#### Post date: [June 29, 2017, 8:55pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/56 "2017-06-29T20:55:31Z")
Which site setting is that? I thought there only is one for the forgot password dialog, but that the sign up process would always disclose if an email address is being used already.
---
### Author:  [@neil](https://meta.discourse.org/u/neil)
#### Post date: [June 29, 2017, 9:16pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/57 "2017-06-29T21:16:24Z")
Youâre right @michaeld that we donât have a setting to hide âEmail has already been takenâ. I like what Hipchat does.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [June 29, 2017, 9:25pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/58 "2017-06-29T21:25:20Z")
Hmm, no, we do have this setting `forgot password strict` and have had it for a long while
I guess we could enhance it to also work that way on account creation, but I _donât_ want to add another setting..
---
### Author:  [@michaeld](https://meta.discourse.org/u/michaeld)
#### Post date: [June 29, 2017, 9:54pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/59 "2017-06-29T21:54:01Z")
> [@codinghorror](#):
>
> but I donât want to add another settingâŚ
How about using the existing one for both the forgot password and signup processes, and eventually renaming it to âdo not disclose email addresses in useâ ?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [September 27, 2017, 9:57pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/60 "2017-09-27T21:57:46Z")
> [@codinghorror](#):
>
> we could enhance it to also work that way on account creation
@neil this one should be unified so we get coverage in both places.
[Previous page](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909.md?page=2)
[Next page](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909.md?page=4)