Hacker News Reader

The title is "bullshit". The real problem is that they leak the information they try not to leak anyway, on a different form. This is a common, but not universal, problem.

It's not OK to leak information, even if that information is maybe leaked somewhere else already.

View on HN

In the GitHub case the handles are public information. Anyone can go to https://github.com/<handle> to verify if it exists. So they trade off usability of a clear error message for no gain at all.

This is true for the username but it's possible to make your email address private on GitHub in which case the message that your email is taken can still be considered an information leak.

You can check if an e-mail is associated with a GitHub account easily. You forge a commit with this email as author email, push it to a foo/bar repo, then look at https://github.com/foo/bar/commits/master .

But to you -- the user entering credentials -- that error message is still accurate. From GitHub's perspective, they don't know which one you entered correctly. It could be argued they should tell you that the username doesn't exist if it doesn't (reasonable with public profile), but in the case of an existing user, this is the only correct error message.

Reply on news.ycombinator.com