Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I understand you feel that way, just want to explain why sites do that. If they give you a clear answer yes or no if it worked, others could check which emails are registered on the website. So in order to leak the information on who has an account or not, they are ambiguous with their answers if the recovery was triggered or not.

It's, as always, about a balance between faster user experience and more extensive security features.



Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: