# Password reset confirm message should discourage social engineering

**URL:** <https://meta.discourse.org/t/password-reset-confirm-message-should-discourage-social-engineering/55330>\
**Category:** Feature\
**Created:** [2017 年1 月 7 日 17:37 UTC](https://meta.discourse.org/t/password-reset-confirm-message-should-discourage-social-engineering/55330 "2017-01-07T17:37:00Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

作者： ![vietnugent](https://avatars.discourse-cdn.com/v4/letter/v/aca169/32.png) [@vietnugent](https://meta.discourse.org/u/vietnugent)\
发布日期： [2017 年1 月 8 日 17:09 UTC](https://meta.discourse.org/t/password-reset-confirm-message-should-discourage-social-engineering/55330/5 "2017-01-08T17:09:20Z")

</div>

@codinghorror thanks I didn’t know there’s a setting for it  
@michaeld yes, it is true that the sign up form confirms for the existence of an email but one can reduce the email visibility by integrating Discourse with external identity providers or creating a custom sign up form with CAPTCHA.

---

_[View the full topic](https://meta.discourse.org/t/password-reset-confirm-message-should-discourage-social-engineering/55330)._