“No account found with that email” is one of the most helpful messages a sign-in page can show. It’s also a gift to anyone trying to learn which of your users have accounts. Run a list of leaked emails against that form and you get back a tidy list of targets.

Say what happens next, not who exists

The fix is to answer the same way whether or not the account exists. Lintel’s components say “Check your email for a sign-in code” for every address, then send a code only to real accounts and a short note to addresses without one. The person at the keyboard learns what to do next. Someone scripting the form learns nothing.

Timing leaks too

Matching the words isn’t enough if a real account takes 300 milliseconds longer to answer. We pad every response to the same duration and run the password check even when the account doesn’t exist, so the timing gives nothing away either.

The trade-off

Uniform messages are slightly less convenient for people who mistype their email. We soften that by showing the address back on the next screen, so a typo is obvious before anyone goes looking in the wrong inbox.