# Hiding "e-mail taken" on sign-up by default

**URL:** https://meta.discourse.org/t/hiding-e-mail-taken-on-sign-up-by-default/342599
**Category:** Announcements
**Created:** [December 19, 2024, 6:51am UTC](https://meta.discourse.org/t/hiding-e-mail-taken-on-sign-up-by-default/342599 "2024-12-19T06:51:03Z")
**Posts on this page:** 1
**Showing post:** 1

<div class="post-metadata">

### Author: ![ted](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ted/32/283882_2.png) [@ted](https://meta.discourse.org/u/ted)
#### Post date: [December 19, 2024, 6:51am UTC](https://meta.discourse.org/t/hiding-e-mail-taken-on-sign-up-by-default/342599/1 "2024-12-19T06:51:03Z")

</div>

### Background

Under the current default settings, when signing up for an account with an e-mail that has already been registered, the sign-up form will inform of that:

 ![Screenshot 2024-12-16 at 12.32.31 PM](https://global.discourse-cdn.com/meta/original/4X/c/f/5/cf550459d9d6a05ebbe15b4df023c3f04c24fe91.png)

We are changing the default setting to not give away this information. Instead, the sign-up form will look like this, regardless of whether the e-mail is already registered or not:

 ![Screenshot 2024-12-16 at 12.30.04 PM](https://global.discourse-cdn.com/meta/original/4X/a/7/d/a7d153f1b606fcbf3970264b329b3945a9b12882.png)

This also affects password resets in similar ways. With the setting disabled, the form provides immediate feedback that the e-mail is in the system:

 ![Screenshot 2024-12-16 at 12.50.11 PM](https://global.discourse-cdn.com/meta/original/4X/7/e/0/7e04c9dce1aefa4b2dea0654f0c4e1afbb43bdb4.png)

With the setting enabled it does not disclose that information:

 ![Screenshot 2024-12-16 at 12.49.08 PM](https://global.discourse-cdn.com/meta/original/4X/3/d/b/3db60e32b78bc4f980588e27b13f7e7e262f8a92.png)

### Why are we changing it?

A malicious actor can use this feedback to perform an [_account enumeration_](https://stytch.com/blog/what-is-an-enumeration-attack/), letting them know whether certain users exist on this forum, which can then let them target those users with phishing.

### Won’t this affect legitimate users negatively?

The case here is if a user forgot that they already have an account, and they try to sign up or reset password using the same e-mail, which should be a relatively rare occurrence. But even then, they will just receive an e-mail letting them know they already have an account.

The change ultimately does not affect legitimate users’ ability to sign up or access their accounts.

### But I prefer the old default

If you have changed this setting at any point, the new default will **not** override the custom setting. If you want to change back to the old default, you can set the `hide_email_address_taken` setting back to `false`.

_Note: we are considering [hiding this site setting](https://meta.discourse.org/t/enable-hidden-site-settings/308773) from the admin settings page in the future._

---

_[View the full topic](https://meta.discourse.org/t/hiding-e-mail-taken-on-sign-up-by-default/342599)._