Why "this email does not exist" is a problem
Account enumeration is the vulnerability everyone knows half of: the half that is known is the error message, and the other three channels are not.
First, why it is a problem — because this is where people wave it away with "an email is not a secret":
- It turns a list of emails into a list of users. A list leaked from elsewhere filters down to "people who have an account here" — and that is the target list for password spraying with already-breached passwords.
- For some services, having an account is itself sensitive. A mental-health app, a legal service, a job board: confirming
alice@corp.localhas an account discloses something about Alice. - It is step one of every attack on authentication. Nobody brute-forces an email they do not know exists.
Four channels, and the bottom three stay open after you unify the error messages:
| Channel | How it shows | Why it is hard to close |
|---|---|---|
| 1. Error message | "Email not found" vs "Wrong password" | Easiest — one string |
| 2. Response timing | A non-existent email returns faster because there is no hash to verify | Needs deliberate slowing |
| 3. Registration flow | "Email already in use" at sign-up | Cannot be silent — the user needs to know |
| 4. Password reset | "Email sent" vs "No such account" | Same shape as 1, at a different endpoint |
Channel 2 deserves the most attention because it is exposed by the fix for channel 1. Hashing with Argon2id deliberately costs 50–100 ms. If the email does not exist, the code returns early and hashes nothing — so the response comes back in 5 ms. That 20x difference is reliably measurable over a network, and it says precisely what the error message was just fixed not to say.
Channel 3 is the one that cannot be fully closed, and that is a genuine trade-off to decide rather than ignore.
Comments
Commenting needs an account with at least one completed lesson. That condition is what keeps this thread worth reading: every point belongs to someone who can be asked back, and reputation accrues over time.
You can still read every comment below without an account. Signing in brings you back to this exact spot, not to the top of the page.
Loading comments…