Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was just implementing a new feature on the registration form of my site that checks if an email address is still available to register an account with. I am wondering if it is secure to show a user that a certain email address is no longer available.

Is this feature a security risk related to the privacy of my members and how can I use it while defending against bots looking for email addresses?

share|improve this question
    
There is no difference then telling that a username cannot be used. Do you really expect people to use the same email account multiple times when its not the email account's owner using it? If you do then I suggest a verification to stop abuse. I am partial in just allowing the email address to be used mutliple times unless there is a specfic reason not too ( i.e. its used as the username of the user's profile ) –  Ramhound Mar 19 '12 at 13:48
add comment

2 Answers

up vote 8 down vote accepted

It does leak information on what email addresses have already been used, but this is only really an issue if an attacker can rapidly check through possible email addresses.

The simple solution is:

  • only allow a small number of attempts or requests from a particular IP in a session

This way a valid customer can still try a couple if their initial choice is unavailable, but an attacker attempting to enumerate email addresses will have start new sessions.

share|improve this answer
add comment

A way to implement the availability check without giving any feedback to potential attackers is to always send an email to the address used for the registration. What the content of the email could look like:

  • "An account for a@b.c [with username xy] was just registered at $site. Click here to confirm."
  • "Somebody tried to register an account for a@b.c [with username xy] at $site, however this account already exist. If you forgot your password click here. If did not initiate the registration please disregard this email."

This way, only the real owner of the email address will be able to check whether the address has already been used to sign up for the service. This approach is for example used by Ubuntu One.

share|improve this answer
    
Excellent answer. Only notify the owner of the email. If the registrant really owns that email address, they will see that they're trying to create a duplicate account. –  Kelvin Nov 1 '12 at 19:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.