There is also the question of leaking whether a given user has an account on a website or not.
Maybe I don't want my employer to know that I have an account on competitor-service.com, or my partner to know that I have an account on kinky-thing.website.
It might not be a security issue, but it could be a privacy issue.
Maybe I don't want my employer to know that I have an account on competitor-service.com, or my partner to know that I have an account on kinky-thing.website.
It might not be a security issue, but it could be a privacy issue.