Reset password requests should not respond failure or success

Nobody has claimed this yet.

When requesting to change password towards a 3PID like an email address there are different responses for success or failure. Failure meaning that the email address was not found in the database, and success meaning that the email address was found and that an email was successfully sent.

Reason why this is bad is because then some one or some thing could start listing successful and failed email addresses or other 3PID personal data.

A failure should result in the request ending up in a black hole, and the response should always be the same, something like or similar to: "A reset validation email has been sent to the registered address, please check your email account and if you have received none please contact the HS admin."

The API should respond that it received the request, that it could and did handle it. Whether or not the email was sent can be seen from the email accounts inbox, if the email address existed in the database.

Several failed reset password requests from same source should also be flagged and if available sent to HS owner, such a setting should perhaps be turned of by default, but that is my own opinion.

The issue names no file, test, or entry point. Start by locating the password-reset API definition in the Matrix specification and review how success and unknown 3PID cases are described; done means the API specifies an indistinguishable response without exposing whether the address exists.

Written by the indexing model from the issue text.