# Password reset confirm message should discourage social engineering

**URL:** <https://meta.discourse.org/t/password-reset-confirm-message-should-discourage-social-engineering/55330>\
**Category:** Feature\
**Created:** [2017 年1 月 7 日 17:37 UTC](https://meta.discourse.org/t/password-reset-confirm-message-should-discourage-social-engineering/55330 "2017-01-07T17:37:00Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

作者： ![vietnugent](https://avatars.discourse-cdn.com/v4/letter/v/aca169/32.png) [@vietnugent](https://meta.discourse.org/u/vietnugent)\
发布日期： [2017 年1 月 7 日 17:37 UTC](https://meta.discourse.org/t/password-reset-confirm-message-should-discourage-social-engineering/55330/1 "2017-01-07T17:37:00Z")

</div>

The password reset logic confirms whether en email exists in the user database. This is generally considered bad practice as it enables malicious users to “query” discourse user db. DigitalOcean is a good example of being vague about the provided email, “if the email you specified exists in our system, we’ve sent a password reset link to it”

 ![](https://global.discourse-cdn.com/meta/original/3X/b/5/b5a1fd78956bce4953769f4a04d62a68e1587f13.png)

---

_[View the full topic](https://meta.discourse.org/t/password-reset-confirm-message-should-discourage-social-engineering/55330)._