security - Requiring unique email addresses while protecting the privacy of your users? -


I set up my website to require a specific email address (no two users have the same email address ), But I realized that it can allow a person to check that someone is registered on my website in an attempt to signup from that email. It is believed that this person will have to know the email address they wanted to try, but this can be useful information for some people (like competitors who want to see if their users are registered on my website or not ).

Is there any real way to stop it, or is it just to be accepted as a possibility?

EDIT: To be just clear, this is about creating an account even if you provide a general "invalid login" for bad login, you must provide usernames or email addresses Due to not being valid, why would a unique email address or user name be required?

Extra, very later edit: One thing that has not been considered here is that when you create the account after change your unique email addresses Here, the solution that I have accepted to send an "forgotten password" email does not work nearly the same. Instead, it seems that the only option is to use captchas or limitations several times, to limit automatic efforts, an email address can be changed at some time.

If someone tries to sign up with an existing account & mdash; Send a "Change your password" email instead of a "new account" email (and explain why).

The HTML response has been sent to your address as a simple "A confirmation email. Follow the instructions to continue ".


Comments

Popular posts from this blog

c++ - Linux and clipboard -

Visual Studio 2005: How to speed up builds when a VSMDI is open? -

booting ubuntu from usb using virtualbox -