Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
2 deleted 1 character in body
source | link

An intuitive and simple solution is to make sure that an automated script (malicious script) cannot try to register with a list of e-mails in order to figure out which ones are registered. For example, use CAPTCHA challenge as part of registeration to make sure it is a human trying to register an account. In this way, even if few user e-mails are tried, a massive number cannot be checked. Note we are assuming strong CAPTCHA cannot be easily broken.

But if it is super sensitive and you must hide who is registered at the target website even from human users, then finish the registration and do not show any error message to the user that the e-mail is already registered; and just inform the user at the end of the process that now they have to confirm the e-mail belongs to them, please go and check your e-mail; In the backend, if the e-mail is already registered, then do nothing; just send an e-mail to the owner of the e-mail and inform them: seems you tried to re-register at our service again, if you have forgotten you have an account with us, this is your username, and if you cannot remember your password, go to the password reset page. To be at the safe side, you can mention that if you did not try to register with us again, please ignore this e-mail.

If the e-mail is not registered in the database, in the backend, create a random one-time useruse token in a URL and send to the new e-mail registered and ask them to confirm the new account if they meant to create a new account.

This way is you absolutely hide everything from the bad guys;

An intuitive and simple solution is to make sure that an automated script (malicious script) cannot try to register with a list of e-mails in order to figure out which ones are registered. For example, use CAPTCHA challenge as part of registeration to make sure it is a human trying to register an account. In this way, even if few user e-mails are tried, a massive number cannot be checked. Note we are assuming strong CAPTCHA cannot be easily broken.

But if it is super sensitive and you must hide who is registered at the target website even from human users, then finish the registration and do not show any error message to the user that the e-mail is already registered; and just inform the user at the end of the process that now they have to confirm the e-mail belongs to them, please go and check your e-mail; In the backend, if the e-mail is already registered, then do nothing; just send an e-mail to the owner of the e-mail and inform them: seems you tried to re-register at our service again, if you have forgotten you have an account with us, this is your username, and if you cannot remember your password, go to the password reset page. To be at the safe side, you can mention that if you did not try to register with us again, please ignore this e-mail.

If the e-mail is not registered in the database, in the backend, create a random one-time user token in a URL and send to the new e-mail registered and ask them to confirm the new account if they meant to create a new account.

This way is you absolutely hide everything from the bad guys;

An intuitive and simple solution is to make sure that an automated script (malicious script) cannot try to register with a list of e-mails in order to figure out which ones are registered. For example, use CAPTCHA challenge as part of registeration to make sure it is a human trying to register an account. In this way, even if few user e-mails are tried, a massive number cannot be checked. Note we are assuming strong CAPTCHA cannot be easily broken.

But if it is super sensitive and you must hide who is registered at the target website even from human users, then finish the registration and do not show any error message to the user that the e-mail is already registered; and just inform the user at the end of the process that now they have to confirm the e-mail belongs to them, please go and check your e-mail; In the backend, if the e-mail is already registered, then do nothing; just send an e-mail to the owner of the e-mail and inform them: seems you tried to re-register at our service again, if you have forgotten you have an account with us, this is your username, and if you cannot remember your password, go to the password reset page. To be at the safe side, you can mention that if you did not try to register with us again, please ignore this e-mail.

If the e-mail is not registered in the database, in the backend, create a random one-time use token in a URL and send to the new e-mail registered and ask them to confirm the new account if they meant to create a new account.

This way is you absolutely hide everything from the bad guys;

1
source | link

An intuitive and simple solution is to make sure that an automated script (malicious script) cannot try to register with a list of e-mails in order to figure out which ones are registered. For example, use CAPTCHA challenge as part of registeration to make sure it is a human trying to register an account. In this way, even if few user e-mails are tried, a massive number cannot be checked. Note we are assuming strong CAPTCHA cannot be easily broken.

But if it is super sensitive and you must hide who is registered at the target website even from human users, then finish the registration and do not show any error message to the user that the e-mail is already registered; and just inform the user at the end of the process that now they have to confirm the e-mail belongs to them, please go and check your e-mail; In the backend, if the e-mail is already registered, then do nothing; just send an e-mail to the owner of the e-mail and inform them: seems you tried to re-register at our service again, if you have forgotten you have an account with us, this is your username, and if you cannot remember your password, go to the password reset page. To be at the safe side, you can mention that if you did not try to register with us again, please ignore this e-mail.

If the e-mail is not registered in the database, in the backend, create a random one-time user token in a URL and send to the new e-mail registered and ask them to confirm the new account if they meant to create a new account.

This way is you absolutely hide everything from the bad guys;