Why forgotten password forms shouldn't tell you when the email doesn't exist | Hacker News Reader