On: New Approaches To Designing Log-In Forms

[dunham]

I believe revealing whether or not an email address has an account is also considered a security issue.

[pornel → dunham]

Validation on registration form reveals this already.

[subsection1h → pornel]

Well-designed registration forms should not reveal this. Our registration forms provide the error "Email address or password is incorrect. Please try again." Further, forgotten password forms, etc. should also not reveal this.

[huhtenberg → subsection1h]

Pssst... the registration form, not the login form. As in sorry, we cannot create you an account as your selected username has already been taken.

[itsnotvalid → huhtenberg]

as a matter of fact, they don't strictly tell you who the person is with an email address... they just tell you that the email address is taken.