It seems common practice to not positively indicate during a password reset attempt whether the email requested is actually registered or not. This makes sense because knowing that an email is registered will give an attacker a potential vector for exploit.

However - how does one do this during the new account registration process? I cannot create an account for an email that already exists, I can merely tell the user that they already have an account and they did they mean to log in instead (etc).

Obviously this exposes the fact that the given email is already registered. Is there any clever way to prevent this? Am I overthinking this?

  • 6
    Well, in the event an email is registered for a second time, you could just tell the front-end user to check their emails for further instructions on registration, which then notifies the email account holder that they are already registered, in which case nothing is revealed at the front end about whether the email was already registered - so to that extent, this is the "clever way". But at some point, you're going to have to reveal something to someone. – Steve May 12 '20 at 21:18
  • 3
    An attacker is more likely to deduce this by attempting a login. A simple timing attack is enough. If the account exists it takes Xms, where as if it doesn't it takes Yms. Frankly it is better to simply point out that the account has already been registered (so that you present a good customer centric image after all 99% of registrations are probably legit), and contact the account holder indicating possibly fraudulent activity, particularly if done from a different part of the world. Encouraging dual factor authentication, and that they ensure they are using a strong and secure password. – Kain0_0 May 13 '20 at 2:04
  • 4
    @Kain0_0 many authentication implementations already take that into account and return a result in approximately the same time regardless of whether the account does not exist or exists and a wrong password was given (often you would even add artificial delays to make brute-forcing harder). The variance in network communication delays makes timing attacks over internet pointless unless the authentication system has really bad timing differences between the two cases. – Hans-Martin Mosner May 13 '20 at 6:00
  • 1
    How about this - to register, you put in your email and it sends you an email. If you're already registered, it sends you an email to just sign in (and an option to reset your password). if you aren't, it sends you a link to "continue signup", which would knock out email validation for registration in one easy pass. – Carson Graham Aug 20 '20 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.