Is it secure to have an “email no longer available” feature on your registration form?

Question

I was just implementing a new feature on the registration form of my site that checks if an email address is still available to register an account with. I am wondering if it is secure to show a user that a certain email address is no longer available.

Is this feature a security risk related to the privacy of my members and how can I use it while defending against bots looking for email addresses?

Answer 1

It does leak information on what email addresses have already been used, but this is only really an issue if an attacker can rapidly check through possible email addresses.

The simple solution is:

• only allow a small number of attempts or requests from a particular IP in a session

This way a valid customer can still try a couple if their initial choice is unavailable, but an attacker attempting to enumerate email addresses will have start new sessions.

Answer 2

A way to implement the availability check without giving any feedback to potential attackers is to always send an email to the address used for the registration. What the content of the email could look like:

• "An account for a@b.c [with username xy] was just registered at $site. Click here to confirm."
• "Somebody tried to register an account for a@b.c [with username xy] at $site, however this account already exist. If you forgot your password click here. If did not initiate the registration please disregard this email."

This way, only the real owner of the email address will be able to check whether the address has already been used to sign up for the service. This approach is for example used by Ubuntu One.