4 ms·
That won’t really help in general because you can go try to sign up with an email address. It has to tell you if the address is already taken or not.
by RcouF1uZ4gsC 8y ago
That won’t really help in general because you can go try to sign up with an email address. It has to tell you if the address is already taken or not.
- 0x6c6f6c 8y agoAbsolutely. It's really more relevant with services you can't directly sign up for, such as an internal service in the company where user enumeration helps you find a target when the error messages are different.
- insomniacity 8y agoNot quite - best practice is to continue the initial setup - ie, "we've sent you a link, please click to activate your account". Except if the email address is already in use, you email the address and let them know that. That way they only leak that info to the owner of the email address - and they can include a password reset link too.
- MattSayar 8y agoHow about for websites that give you some functionality without a verified email address? At that point, you can't let a user dink around if the address is in use. Granted, this doesn't apply to eg banks, but there's plenty of websites where this could apply.
- JimDabell 8y agoDon't ask for their email address then. What's the point in having an email address that you have no idea if it's correct or not? You might as well ask them to put in a random string of characters.