Unverified50% confidenceDecision RuleExact time
Email matching is only safe on the premise that the identity provider has verified that email.
1
Sources
50%
Confidence
Long-term
Relevance
11/4/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedNonexistent email and incorrect password should return the same message to prevent attackers from probing registered emails.79% similarUnverifiedAn implementation check should confirm three points: binding precedes email matching, email matching takes effect only when the identity provider states the email is verified, and the binding record includes the stable identifier and source information.78% similarUnverifiedIn OIDC, email is merely an attribute declared by the provider and may be unverified; email_verified indicates that the provider has confirmed that the email is controlled by the current user, while sub or provider_user_id is the stable and hard-to-forge identity identifier.74% similarUnverifiedEmail discovery is evidence-driven: it never guesses email addresses, but instead checks whether an email is publicly associated with the doctor, validates syntax format, and uses deterministic rules to exclude HKU-related domains.72% similarVerifiedMany online services do not enforce an email verification process during user registration, allowing users to complete registration with an email address that does not belong to them.72% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1134490API
curl https://kongchang.com/api/v1/knowledge/claims/1134490MCP
get_claim(id=1134490)