Account verification on the Password Reset page

  • Hi,
    At the moment, if someone tries to reset the account’s password, the message is “If an account matching the provided details exists, we will send a password reset link. Please check your inbox.”
    However, many of our users do not have an account yet, and this message is not always informative. Is there a way to check if an account/email exists, when clicking on “Reset Password”, or on the next page?

    Thank you in advance for your help!
    Franz

    • This topic was modified 2 years, 4 months ago by franzlaut.

    The page I need help with: [log in to see the link]

Viewing 4 replies - 1 through 4 (of 4 total)

  • @franzlaut

    If you are located within the European Union and must follow GDPR you should not reveal email addresses on your site. Email addresses are personal data protected by GDPR.

    • This reply was modified 2 years, 4 months ago by missveronica.
    Thread Starter franzlaut

    (@franzlaut)

    @missveronicatv
    Thank you for your reply. We are not planning to reveal addresses, but simply inform the user if the email entered in the ‘reset password’ form is not linked to any account, otherwise they might just expect to receive an email if they think they have an account. Or is that what you meant by revealing email addresses?

    @franzlaut

    Is there a way to check if an account/email exists, when clicking on “Reset Password”, or on the next page?

    With this email check and a positive reply you have revealed the email address. This email address can then be used for illegal activities.

    https://github.com/ultimatemember/ultimatemember/pull/1058

    Thread Starter franzlaut

    (@franzlaut)

    @missveronicatv
    Your reply makes sense, I didn’t consider that it could be used like that maliciously. I’ll simply edit the message to make it a bit more informative, in case users are wondering why they didn’t receive an email.
    Thank you again!

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Account verification on the Password Reset page’ is closed to new replies.