Also worth noting that time response deviance when user exists or not can also be a leak of info