when starting a recovery flow, is it possible to h...
# talk-kratos
d
when starting a recovery flow, is it possible to have kratos show an error in the UI if the email address entered does not exist? Rather than configuring ory to send an email that recovery was attempted but the account doesn’t exist
b
My understanding is that this isn’t possible because it opens up account enumeration attacks. The documentation links to a blog post by Troy Hunt that describes the attack: https://www.troyhunt.com/website-enumeration-insanity-how-our-personal-data-is-leaked/
d
yeah that’s what I had assumed, thanks