Yeah it's a neat attack. pretty glaring info leak imho. Even an empty array response can expose login status