If there are other ways to confirm whether a user exists or not (signup email check for example) --
I would add that the 'bonus' of not informing of the correct error provides minimal security gain and hurts usability.
I would add that the 'bonus' of not informing of the correct error provides minimal security gain and hurts usability.
This would be a bug. There should be no way for someone with my e-mail address to determine if I use any particular service.