The more secure systems I've been to don't acknowledge whether or not the account exists. I've actually seen a message that said something like
"If an account exists for that email address, it will receive an email shortly."
As I said (or meant to say) earlier, how anal you are has a little bit of luxury dependent on the nature of the site. If it's a social network, it's probably fine to show that usernames exist (unless their profiles are specifically flagged to be private), as part of the site shows that their usernames exist already. I could easily harvest usernames on HN here without ever having to test against the password form.
If your site is of a more personal, sensitive, embarrassing or whatever other situation you can concoct, then of course you'd want to adjust your username/password strategies accordingly.
"If an account exists for that email address, it will receive an email shortly."
As I said (or meant to say) earlier, how anal you are has a little bit of luxury dependent on the nature of the site. If it's a social network, it's probably fine to show that usernames exist (unless their profiles are specifically flagged to be private), as part of the site shows that their usernames exist already. I could easily harvest usernames on HN here without ever having to test against the password form.
If your site is of a more personal, sensitive, embarrassing or whatever other situation you can concoct, then of course you'd want to adjust your username/password strategies accordingly.