Password reset workflow reports when provided username doesn't exist

[rjsparks]

Instead, it should say nothing, and always note where to go for account creation.

[rjsparks]

Same issue exists in the change username workflow.

[larseggert]

Same issue exists in the change username workflow.

Can you say more about what the issue with that workflow is? (Or did you mean "create user" workflow?)

[rjsparks]

There is a workflow that allows a user to change their username. Time-wise, it should cost the user roughly the same to try a new user name and find it's already taken vs being allowed to take it. The point is to avoid making it cheap to farm existing usernames.

[larseggert]

So this is when adding new emails addresses to an existing profile then? Because the "change username" form is a select.

[rjsparks]

hmm. I added the second comment while scanning code for a different reason. I'll have to relocate what made me add it. I agree that ietfauth.views.change_username and its use of ietfauth.forms.ChangeUsernameForm doesn't have this particular problem.

[larseggert]

I think it's the account creation form. It also exposes when an email already has an account.

[larseggert]

Fixed by #5288