Not really. The points the author makes are only valid if you presuppose they are correct in that "account e-mails for a site are already public elsewhere", and that isn't a problem on its own.
Many best practices are already what the author suggests: If a user signs up and doesn't already exist, send them an e-mail to confirm they own the e-mail. If that user already has an account, send their e-mail a message to the effect of "Someone tried to sign up to our service as you, is this you? If not, it's safe to ignore this message. Here's how to reset your password in case you lost that: ..."
The thing the author is missing here is the same failure I see at a lot of companies: they take the approach that they're only there to protect their application, rather than doing what they can to protect the users of the application. Something as simple as knowing a user uses a service can become an easy spearphishing attack, for example, which the author doesn't mention.
The general recommendations are good but defense in depth is key.
Many best practices are already what the author suggests: If a user signs up and doesn't already exist, send them an e-mail to confirm they own the e-mail. If that user already has an account, send their e-mail a message to the effect of "Someone tried to sign up to our service as you, is this you? If not, it's safe to ignore this message. Here's how to reset your password in case you lost that: ..."
The thing the author is missing here is the same failure I see at a lot of companies: they take the approach that they're only there to protect their application, rather than doing what they can to protect the users of the application. Something as simple as knowing a user uses a service can become an easy spearphishing attack, for example, which the author doesn't mention.
The general recommendations are good but defense in depth is key.