# Password reset confirm message should discourage social engineering

**URL:** <https://meta.discourse.org/t/password-reset-confirm-message-should-discourage-social-engineering/55330>\
**Category:** Feature\
**Created:** [2017 年1 月 7 日 17:37 UTC](https://meta.discourse.org/t/password-reset-confirm-message-should-discourage-social-engineering/55330 "2017-01-07T17:37:00Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

作者： ![michaeld](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/michaeld/32/1594_2.png) [@michaeld](https://meta.discourse.org/u/michaeld)\
发布日期： [2017 年1 月 7 日 22:46 UTC](https://meta.discourse.org/t/password-reset-confirm-message-should-discourage-social-engineering/55330/4 "2017-01-07T22:46:09Z")

</div>

The signup form already gives away if an email address already exists (and turning that off doesn’t make sense) so it doesn’t really matter here, it doesn’t make that attack vector go away and it only makes things harder for users who actually forgot their password (or: forgot their email address)

---

_[View the full topic](https://meta.discourse.org/t/password-reset-confirm-message-should-discourage-social-engineering/55330)._