Comment on Coinbase design allows for mass, targeted phishing of its usersparentComments−krallja12yDon't allow users to determine whether an email address is registered in your system. (Even if they click "forgot password" or "send money request").More importantly, don't ever give the user the full name of someone whose email address they pulled out of thin air!−nbody12ySeems viable, and if you had previous "relationship"/transaction with this user you can display name etc.
Comments
Don't allow users to determine whether an email address is registered in your system. (Even if they click "forgot password" or "send money request").
More importantly, don't ever give the user the full name of someone whose email address they pulled out of thin air!
Seems viable, and if you had previous "relationship"/transaction with this user you can display name etc.