Clarification Needed: Passwordless Authentication Implementation

[sumansaurav]

Hi @robertdhero ,

There are 2 major potential security concern I can think of:

1. Account Enumeration Concern: Attackers could try to discover valid accounts.
2. Automated Account Creation Concern: Bots could create many accounts automatically

There are ways you mitigate account enumeration or Bot attack. Here is post on Auth0 community you can refer:

Preventing user enumeration on sign up

We want to prevent the possibility of a malicious actor enumerating existing users via the sign-up form / API. Currently, if a user tries to sign up with an email that already is in our system, they get an error. If they try to sign up with an email not in our system, they succeed. Therefore user enumeration is possible (regardless of whether the error specifically mentions that the user exists or not). We’d like the sign-up form to display a success message stating that a verification email h…