# Email enumeration vulnerability on "Password Reset" dialogue **URL:** \ **Category:** UX\ **Created:** [August 1, 2023, 7:37am UTC](https://meta.discourse.org/t/email-enumeration-vulnerability-on-password-reset-dialogue/273449 "2023-08-01T07:37:41Z")\ **Posts on this page:** 1\ **Showing post:** 14
**Author:** ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)\ **Post date:** [August 4, 2023, 6:22am UTC](https://meta.discourse.org/t/email-enumeration-vulnerability-on-password-reset-dialogue/273449/14 "2023-08-04T06:22:08Z")
> [@dobon](#): > > ‌1. **Google** : does _not_ allow user enumeration. > 2. **YouTube** : does _not_ allow user enumeration (because it uses Google login, and Google doesn’t allow user enumeration). This is somewhat disingenuous as the arguably main Google product (gmail) allows enumeration. ![Screenshot_2023-08-04-02-01-02-34_3aea4af51f236e4932235fdada7d1643](https://global.discourse-cdn.com/meta/original/4X/0/9/0/09063a3b875da9b0b609d8cd098f77023eea70a9.jpeg) It’s otherwise trivial to test for the existence of accounts on email identity _providers_, so there’s not much point in even including them in the list. > [@dobon](#): > > I struggle to understand why we are giving administrators the ‘feature’ of making their Discourse installation marginally less secure and standards compliant for no clear benefit. _None_ of the other platforms in that list are (potentially) self-hosted software. There is no Central Discourse Platform - site administrators are _free to choose for themselves_. That said I would agree with giving a nudge to site admins to choose good settings by default. Maybe a knob admins can turn (I hesitate to suggest adding this to the wizard) to tighten down settings like this easily. --- _[View the full topic](https://meta.discourse.org/t/email-enumeration-vulnerability-on-password-reset-dialogue/273449)._