> Is there no longer a panic over letting an attacker know that an account does exist?

There's simply no way to get around this if users can pick their own usernames (other than assigning them in an unpredictable manner). In other cases, usernames being publicly available is a feature, not a bug.

[0] https://imgur.com/a/qCupYyQ

It’s difficult for an email system, but for other systems this can be solved by having a “display name” and a login (which may be your email).

> this can be solved by having a “display name” and a login

You have three choices with a user specified login name. You can:

(1) notify a user why account creation has failed (due to a duplicated login name)

(2) fail silently and have frustrated users leave your account creation page

(3) allow duplicated login credentials

In my mind, (2) and (3) are worse than (1). Since the question regards security practices, obfuscating the login name with a display name does not mitigate this vulnerability.

If you rate limit the account creation endpoint, you will minimize the ability of an attacker to brute force all usernames of your service, but you cannot prevent an attacker from determining if a specific account exists (apart from assigning login credentials).

Oh good point. I forgot about the whole sign up validation portion :)

It's a tradeoff between security and usability

https://security.stackexchange.com/questions/158075/is-it-un...

For things that are pentested/audited to some level of compliance standard this is still very much known. It's under the heading of the error message gives too much away.

I haven't heard an update on that front for many years, so I'd assume it should still be a concern.

Many of the same sites that do this will also have a recovery form that refuses to leak information.

That’s important. I find it funny[1] when you get the “email does not exist” error on a password reset page.

[1] by “funny” I mean not funny

I wonder if that's a way for spammers to harvest known good e-mail addresses.

Those are available for free on the internet dude. This is a non-concern. The bad guys don't listen to GDPR. There are entire email lists available.

And how are such lists constructed?

You just breach someone with a lot of them.

Would it not be easier/more legal to scrape them using leaky login forms?

I believe the breached lists rapidly become public. You can find them on the internet.

It's still a concern, but often forgotten.