I am currently reading the book "Web Security of Developers" and it talks about avoiding Username Enumeration, and it makes no mention of the registration/signup page for your system. I've searched the web and haven't found anything either.
It seems to me that an attacker could simply try signing up for your website with a series of usernames, and that would constitute username enumeration to the same extent as overly informative login failure or password reset pages.
Is this assessment correct or is there something I've overlooked here? Also, if I am right about this, is there a known mitigation approach?