What is account enumeration, where does it typically leak, and how do you prevent it?

Account enumeration means an attacker can tell if an account exists by watching how the app behaves.

Typical leaks:

• Login errors that differ, like "user not found" versus "wrong password".
• A signup form that says the email is already taken.
• A password reset page that only confirms known addresses.
• Timing differences. The server skips password hashing for unknown users, so those responses come back faster.

Defences:

• Return one generic message for failed logins: "invalid username or password".
• Make reset responses identical, whether or not the account exists: "if an account exists, we sent an email".
• Keep timing the same. For example, check the password against a dummy hash when the user doesn't exist.
• Add rate limiting (a cap on requests per user or IP), so the remaining leaks are slow and expensive to use.

Why it matters: a confirmed list of real accounts makes attacks much easier. One is credential stuffing, which means trying passwords leaked from other sites. Another is targeted phishing. So the small cost to user experience is worth it.