# Password reset security issue

**URL:** <https://www.phphelp.com/t/password-reset-security-issue/26717>\
**Category:** Site Feedback\
**Created:** [July 20, 2018, 5:47am UTC](https://www.phphelp.com/t/password-reset-security-issue/26717 "2018-07-20T05:47:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![streakerstyle](https://www.phphelp.com/user_avatar/www.phphelp.com/streakerstyle/32/1837_2.png) [@streakerstyle](https://www.phphelp.com/u/streakerstyle)\
**Post date:** [July 20, 2018, 5:47am UTC](https://www.phphelp.com/t/password-reset-security-issue/26717/1 "2018-07-20T05:47:46Z")

</div>

Hi there,

I stumbled back upon this website after last using it in 2013, really liked the upgrade you guys gave it.

Now, the first thing I did was reset my password, but I couldn’t help but notice that when I entered my e-mail address I got the message: “We found your email”, so I tried a fake email, and got the message: “No account matches xxx@xxx.xxx”, this is a potential risk to the website as it is very easy for me to simply run a database of e-mail addresses / usernames on this screen and simply see who is using this website and who isn’t and target them directly.

I would advise you to change the 2 different messages to 1 generic message along the lines of:  
“If there was an account associated with , you will receive an email within the next 24 hours.”

I do hope this will be taken into consideration.

---

<div class="post-metadata">

**Author:** ![astonecipher](https://www.phphelp.com/user_avatar/www.phphelp.com/astonecipher/32/2797_2.png) [@astonecipher](https://www.phphelp.com/u/astonecipher)\
**Post date:** [July 20, 2018, 2:35pm UTC](https://www.phphelp.com/t/password-reset-security-issue/26717/2 "2018-07-20T14:35:09Z")

</div>

Don’t know enough about this software, but the old you could search users. I don’t see how knowing that a person uses a site is a security risk. Could you enlighten me?

---

<div class="post-metadata">

**Author:** ![John](https://www.phphelp.com/user_avatar/www.phphelp.com/john/32/1829_2.png) [@John](https://www.phphelp.com/u/John)\
**Post date:** [July 20, 2018, 3:43pm UTC](https://www.phphelp.com/t/password-reset-security-issue/26717/3 "2018-07-20T15:43:39Z")

</div>

Good point. This could lead to issues with phishing.

I’ve changed it to show the same message regardless of the email being in the db:

> If an account matches **%{email}** , you should receive an email with instructions on how to reset your password shortly.

---

<div class="post-metadata">

**Author:** ![streakerstyle](https://www.phphelp.com/user_avatar/www.phphelp.com/streakerstyle/32/1837_2.png) [@streakerstyle](https://www.phphelp.com/u/streakerstyle)\
**Post date:** [July 20, 2018, 4:39pm UTC](https://www.phphelp.com/t/password-reset-security-issue/26717/4 "2018-07-20T16:39:16Z")

</div>

@astonecipher exactly as @John said, main concern was phishing, and in general, the less information you’re giving away, the more secure the platform.

& @John thanks for the quick response and change!