3 ms·
It's not a difficult problem to solve. Just let the sign-up succeed whether an account already exists for the email or not. Then say "You will receive an email
by x1j7xJuzX 12y ago
It's not a difficult problem to solve. Just let the sign-up succeed whether an account already exists for the email or not. Then say "You will receive an email with instructions to complete your registration".
If there was no existing account, send an email with the text: "An account was created for this email address at Example.com. If you requested this account, you may activate it by clicking here: https://..." https://..."
If there was an existing account, send: "An attempt was made to create a new account at Example.com for this email address, but you already have an account. If you have forgotten your password, visit https://..." https://..."
- jdbernard 12y agoThat works for sign-up, but not for the far more common case of sign-in.
- birdmanjeremy 12y agoIf you use this approach, the idea is then that you use a generic login failure message. This prevents leaking of any account information, but provides a different (poorer, IMO) user experience.
- birdmanjeremy 12y agoYes, this was the alternative we discussed. We opted to go with the simpler (and very common) signup process, which does admittedly leak some information.