Smf2.1: [security] email @ password reset

[albertlast]

More or less the the same question like username,
when you use reset password function.
smf tell the user if the email address is used or not:

Is this behavior good?
In my eyes this information is not avaible in the member list,
so it shouldn't publish here.

[frandominguez03]

What is your suggestion to put there instead of that?

[albertlast]

the same message when successfull:

[frandominguez03]

So, if the user accidentally mistyped his email, he'll be waiting for a never arriving email?

[albertlast]

or try it again after some minutes,
which you need to do any way when the mail gelost of some other mistakes are happening

[frandominguez03]

No, I mean, if you think you put the email correct but you didn't, and the system tells you that you have been sent an email, you won't get one.

[albertlast]

like i said than you try it again when no mail arived,
you could hit "unlucky" someone other mail address.

[Gwenwyfar]

Just change the message to say "an email was sent to [email protected]". If the user typed wrong, he'll see it on that page, and it just says the same message even if no accounts are associated with it.

The message could also say at the end something like "if you didn't receive any email make sure the email is correct or you have an account registered with that email".

[CoreISP]

I'd simply phrase it to something like "An email will have been sent to the provided user/email, should it exist in our database.". Something like that. Simple, straightforward; no info leaked.

[Gwenwyfar]

Can't you also use the register page to check for used emails though?

[CoreISP]

Yep that's true, didn't think about that one.