Should a user registration form indicate if an email address is already in use?

Question

It seems pretty typical to limit user accounts to unique email addresses. So on my user registration form, I am doing email validation and returning a message like

An account has already been registered for [email protected]

Then it occurred to me that an attacker could use this form to determine information about my users. Is there an alternative way to provide validation messages to my users without compromising security? It doesn't seem to me there is any way around it.

Answer 1

Rob Napier's answer is correct. You should decide whether your users actually need that anonymity at the cost of degraded UX (in most cases they wouldn't care).

Here's how some big names do it:

• AWS: Error: Account with this email already exists.
• Apple ID: This email address is not available. Choose a different address.
• Cloudflare: A user with that email already exists (Code: 1079)
• Linkedin: Someone's already using that email.
• Stack Overflow: Forgot your account’s password or having trouble logging into your Team? Enter your email address and we’ll send you a recovery link.

Answer 2

Simply tell them they cannot use the email address they have supplied ? You don't need to give any more reason than that? If they know it's not their email they might still guess it's an existing address but you haven't confirmed that.

Or

How about telling them you've sent an email to that address and they need to confirm - even if you haven't.