# Password reset confirm message should discourage social engineering

**URL:** <https://meta.discourse.org/t/password-reset-confirm-message-should-discourage-social-engineering/55330>\
**Category:** Feature\
**Created:** [Janeiro 7, 2017, 5:37pm UTC](https://meta.discourse.org/t/password-reset-confirm-message-should-discourage-social-engineering/55330 "2017-01-07T17:37:00Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\
**Post date:** [Janeiro 7, 2017, 9:30pm UTC](https://meta.discourse.org/t/password-reset-confirm-message-should-discourage-social-engineering/55330/3 "2017-01-07T21:30:03Z")

</div>

If you want this, enable it in site settings. Already exists.

By default we tell people since they can never remember which of their 10 email addresses they signed up with, so it is user hostile to force them to walk through all 10 emails to figure out which one they used on your site.

---

_[View the full topic](https://meta.discourse.org/t/password-reset-confirm-message-should-discourage-social-engineering/55330)._