In many web applications, email is required to be a unique field, and users aren't allowed to register an account if their email already exists in the database.

When performing validation on the registration form, you would presumably check if an email has been taken, and let the user know if it has since they can either pick a different one or try to reset their password.

However, if you are providing this feedback, it seems like malicious users could test to see if users exist in the database.  Someone could plausibly test your site against leaked data from big-name hacks, and if the users are reusing their passwords across sites, then your site is potentially vulnerable.

The solution to this could be simply giving more generic feedback about what went wrong without specifically mentioning email, although that could be frustrating for the average user trying to sign up.  And if your sign up form simply requires an email and password, it is still pretty obvious that if any error is encountered it is likely that the email already exists in the database.

What is the best way from a security perspective to handle informing a user that an email has already been taken upon registration?


Question: Why do some people wrap their Tefilin around their arms 8 times?
Answer: I don't know about 8 times, but the Shulchan Aruch OC 27:8 says


  ונוהגין העולם לכרוך על הזרוע ששה או שבעה כריכות
  
  The custom is to wrap [the strap] around the forearm 6 or 7 times.


It seems not only that we should be discussing 6 or 7 and not 8, but also that the exact number doesn't really matter.