3 ms·

How about email validation as a first step and send the "this email is in use" message via email instead of on the sign up form. Adds friction to signup, but w

• latch 4y ago
  I think this is a good idea. It's essentially what I mentioned with Paypal requiring OTP before the signup process starts up. But as you said, it adds a lot of friction to something most companies want to be as frictionless as possible: signups. So it's a compromise. I don't expect many companies will opt for it, except, as you say, those where it's particularly important. I stand by my reply, since my parent implied that username enumeration was rare (i.e. "every so often") and some awful security practice (i.e. "I don't even")