Author: TomH
[Added to the original trac issue at 9.00am, Tuesday, 25th February 2014]

I'm perfectly well aware of that advice, but we have chosen not to follow it in this case because, frankly, it makes for utterly terrible usability.

If the only feedback to let you know if you typed the address right, or if your memory of which address you registered with is correct, is an email that might not arrive until some hours later then the whole experience becomes a nightmare for a (possibly not very technical) user.

As the person who gets the emails when people can't help themselves there is no way I am going to do this I'm afraid.

Author: oxplot
[Added to the original trac issue at 1.56pm, Tuesday, 25th February 2014]

Since you mentioned that you have chosen not to follow it, I assume this has never been implemented. So there is actually no data that this change would increase the number of emails you receive. As a solution to a possible increase, you could show a message to ask the user to retry the procedure should they not receive the email promptly.

Now, regarding "terrible usability", I agree with you but it shouldn't mean abandoning security. You (openstreetmap) are responsible for keeping your users' data confidential. Now Apple's [[https://iforgot.apple.com/password/verify/appleid|Forgot Password feature]] tells you they've sent the email regardless. I mention Apple because they're known for some of the best UX designs. However, [[https://www.facebook.com/login/identify?ctx=recover|facebook]], [[https://twitter.com/account/resend_password|twitter]], [[https://instagram.com/accounts/password/reset/|instagram]], [[http://www.reddit.com/password|reddit]], [[https://en.wikipedia.org/wiki/Special:PasswordReset|wikipedia]], [[https://github.com/sessions/forgot_password|github]] and others do what OSM does. But with a difference, they watch the usage very closely and stop brute force attacks by use of reCAPTHCHA for instance (usability anyone?). In contrast, I just ran a script to try 1000 reset requests in under 2 minutes and OSM answered each and every one of them!

It'd be better usability if no one had to enter a password but we do it because nothing else has the security vs usability balance that password provides. But for reset password functionality, there is a choice. OSM, however, is not doing one or the other, but half of one.

Author: TomH
[Added to the original trac issue at 1.59pm, Tuesday, 25th February 2014]

Those companies also have hundreds or thousands of paid support staff to deal with users who can't manage to reset their passwords. We have me.

Author: TomH
[Added to the original trac issue at 2.01pm, Tuesday, 25th February 2014]

For the record I can't remember the exact history of this feature but in general everything in our authentication etc has been optimised over time in response to experience of the sort of things that confuse users and lead to them emailing us for help.

Author: TomH
[Added to the original trac issue at 2.07pm, Tuesday, 25th February 2014]

To summarise the status of this:

• The reset password page leaks exactly one piece of information - the fact that a given email address is associated with an account. It does not tell you which account or anything else that could not be determined in other ways.

• I have no problem changing the current system if somebody can provide suggestions for a replacement which will not lead to a major loss of usability - a lot of people using that page are not just trying to reset a password for a known account but are unsure if they even have an account so that needs to be born in mind.

• I do not believe that captcha's are generally useful - even the biggest players have trouble keeping their captchas able to resist bots and we would stand no chance.

Author: oxplot
[Added to the original trac issue at 3.01pm, Tuesday, 25th February 2014]

Replying to [comment:3 TomH]:

Those companies also have hundreds or thousands of paid support staff to deal with users who can't manage to reset their passwords. We have me.

And you love your users more than the crowd. Those big companies (e.g. Google) don't actually provide any support for lost accounts. It's just not feasible when you have millions of users (unless they are a paid customer). Heck, they even close people's accounts on suspicion that they're compromised and that's fine.

I have no problem changing the current system if somebody can provide suggestions for a replacement which will not lead to a major loss of usability

Like I mentioned before, implement a rate limiter, like reCAPTCHA but only show it when traffic from an IP goes over a certain threshold. This way, majority of users won't see it (no loss of usability) but if anyone tries to brute force your DB, it gets hard fast. True that reCAPTCHA can be defeated (e.g. human bots), but it's much more difficult and expensive to do compared to a 10 line bash script that I wrote in under a minute.

Now, reading your comments, I just realized that this needs to be done on the sign-up page as well (if not already).