Requiring unique email addresses while protecting the privacy of your users?

Question

I setup my website to require unique email addresses (no two users can have the same email address), but I realized that this could allow someone to check if a person is registered on my website by attempting to signup with that email. Granted that this person would have to know the email address they wanted to try, but it could be useful information for some people (e.g. competitors who wanted to see if their users are registered on my website).

Is there any real way to stop this, or does this just have to be accepted as a possibility?

Edit: just to be clear, this is about creating an account. Even you provide a generic "invalid login" for bad logins, how would you require a unique email address or username without disclosing which usernames or email addresses are valid?

Additional, much later edit: One thing that wasn't considered here was maintaining the requirement for unique email addresses when you let users change their email address after account creation. Here, the solution I accepted of sending a "forgot password" email doesn't work nearly as well. Instead, it seems that the only options are to use captchas or limitations on the number of times an email address can be changed in a certain period of time to limit automated attempts.

Answer 1

If someone tries to sign up with an existing account — send a "Change your password" email instead of a "New account" email (and explain why).

Leave the HTTP response as a simple "A confirmation email has been sent to the address you specified. Follow the instructions in it to continue".

Answer 2

I suppose the issue is if someone forgets their password, you would ask them to enter their email address and you would send the password there if a match was found?

For that you can have users supply a question/answer challenge when they register their email address. Its a bigger pain for your users but if security is a concern then they may go for it.

Another possibility is your registration form. In this case users can enter an email address to see if its already "taken".

To address your concern you should just happily accept all registrations and send a confirmation email, even if they are already registered. That way the user doesn't know if they just registered the email address for the first time or not.

Finally, if an incorrect username/password is given, don't tell the user which is bad.

I don't think it's a terrible security risk unless membership to the site is sensitive, in which case you can use some of the patterns described.