In many web applications, email is required to be a unique field, and users aren't allowed to register an account if their email already exists in the database.

When performing validation on the registration form, you would presumably check if an email has been taken, and let the user know if it has since they can either pick a different one or try to reset their password.

However, if you are providing this feedback, it seems like malicious users could test to see if users exist in the database.  Someone could plausibly test your site against leaked data from big-name hacks, and if the users are reusing their passwords across sites, then your site is potentially vulnerable.

The solution to this could be simply giving more generic feedback about what went wrong without specifically mentioning email, although that could be frustrating for the average user trying to sign up.  And if your sign up form simply requires an email and password, it is still pretty obvious that if any error is encountered it is likely that the email already exists in the database.

What is the best way from a security perspective to handle informing a user that an email has already been taken upon registration?


Question: What is an adjective for "requires a lot of work"?
Answer: If you want a single word for "a lot of work", consider "onerous" or "laborious", though I'm not sure "a lot of work" captures all the relevant obstacles to starting a business.