Hacker News Reader

> That's terrible UX.

I think the goal when the User is a malicious attacker is for them to have a terrible UX.

Huh? He's suggesting that as a Real User that if you don't whether you have an account at all is to just sign up again. People use multiple emails for different accounts all of the time. How is that not a frustrating experience for the Real User?

That's not what is meant.

An attacker who wants to find out of if the person with "example@example.com" has on account on your website, could try signing up with "example@example.com". If they get an error message, they know the person has an account on the website.

Reply on news.ycombinator.com