# Different password reset for wrong username/email
**URL:** https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909
**Category:** Feature
**Created:** [May 23, 2014, 2:16pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909 "2014-05-23T14:16:30Z")
**Posts on this page:** 6
**Page:** 4
### Author:  [@neil](https://meta.discourse.org/u/neil)
#### Post date: [September 29, 2017, 4:31pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/62 "2017-09-29T16:31:35Z")
To be clear, what are we going to do when someone signs up with an email that has already been taken?
- Like Hipchat: respond as if the signup was successful and send an email to the email address suggesting they change their password.
- Respond as if the signup was successful and do nothing.
- Show another error. “Signup is not allowed from this account” (which is also a clue that the email is recognized for some reason)
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [September 29, 2017, 6:04pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/63 "2017-09-29T18:04:11Z")
We currently indicate the email is already taken.
> Primary email has already been taken
For when the “xxxtra email security” site setting is enabled, I like the hipchat approach otherwise, and I think it’s smart. Via email to the specified email address:
> Title: Account already exists at {site}
> You just tried to create an account at {site}. However, an account already exists for `name@example.com`.
>
> - If you forgot your password, [reset it now](https://meta.discourse.org/password-reset).
>
> - If you didn’t try to create an account for `name@example.com`, don’t worry – you can safely ignore this message.
>
> If you have any questions, [contact our friendly staff](https://meta.discourse.org/about).
---
### Author:  [@neil](https://meta.discourse.org/u/neil)
#### Post date: [October 3, 2017, 7:41pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/64 "2017-10-03T19:41:59Z")
This is partially done, except the “account created” page doesn’t show these two buttons:
The absence of these buttons is a clue, so they should probably be faked too.
The setting is renamed to **hide email address taken**.
And while I’m at it, this form is also not covered by this setting:
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [October 3, 2017, 10:09pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/65 "2017-10-03T22:09:58Z")
Any ideas on those two places @michaeld?
---
### Author:  [@neil](https://meta.discourse.org/u/neil)
#### Post date: [October 4, 2017, 3:51pm UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/66 "2017-10-04T15:51:07Z")
I added support to the change email form in user preferences. It will respond as if it was successful, and send the email to the owner of the other account.
> You just tried to create an account at Localhost Discourse, **or tried to change the email of an account to [doggy@woof.com](mailto:doggy@woof.com)**. However, an account already exists for [doggy@woof.com](mailto:doggy@woof.com).
>
> …
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [August 4, 2023, 8:06am UTC](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909/67 "2023-08-04T08:06:05Z")
Closed in favour of [Email enumeration vulnerability on "Password Reset" dialogue](https://meta.discourse.org/t/email-enumeration-vulnerability-on-password-reset-dialogue/273449)
[Previous page](https://meta.discourse.org/t/different-password-reset-for-wrong-username-email/15909.md?page=3)