I'm sure there's plenty of discussion covering this topic on the net but I can't find any!
I am looking at reworking one of my registration forms for a site I run. Currently, user accounts are identified by email (i.e. users login using email and password). I'm getting a fair amount of people who are creating 2 accounts for the same email address which causes a number of problems (e.g. when trying to reset their password, viewing their orders etc). I was going to rewrite my registration form so that it threw an error to the user if they tried to create a duplicate account but then I realised that could give crackers help in trawling real email addresses. A bot could just keep trying email addresses until it got a duplicate response and it would then know on of my user's email addresses.
What's the solution? I need to give my users feedback as to why their registration has failed, but I don't want to reveal information to bots/crackers?
Would a simple CAPTCHA solve the probem?
TIA
