Is there a security reason not to reveal the existence of a user ID?
- by Chris
I've noticed that on some sites, when you request a password reminder or sign in, they'll tell you if the user doesn't exist (I think Meetup does this). Other sites will simply say "the user/password combination is invalid" (Google, I believe, does this).
Is there a security reason for not revealing the existence of a user id?