[Security concern] Don't show if a username exists
Hi,
It would be much better from a security perspective if you won't show if a username doesn't exist. By confirming that an account does not exist, it is implied that when the message is not shown the account, does exist. This creates opportunities for hackers to brute force and find all possible e-mail-addresses that exist on the Zoho servers.
It is unnecessary to show if an account exists or not. Just show a message; unknown e-mail address and/or password like all other main websites do.. for a good reason.
Thank you,
Mark
Access your files securely from anywhere
Zoho Developer Community
Deliver unforgettable customer experiences
Deliver unforgettable customer experiences
New to Zoho Marketing Plus?
Everything you need to run your marketing
New to Zoho Marketing Plus?
Everything you need to run your marketing
Zoho Desk Resources
-
Desk Community Learning Series
-
-
-
-
-
-
-
-
-
Zoho TeamInbox Resources
Zoho DataPrep Resources
Zoho CRM Plus Resources
Zoho Books Resources
Zoho Subscriptions Resources
Zoho Projects Resources
Zoho Sprints Resources
Qntrl Resources
Zoho Creator Resources
Zoho Campaigns Resources
Zoho CRM Resources
Zoho Show Resources
Writer Get Started. Write Away!
Writer is a powerful online word processor, designed for collaborative work.