How to protect potential attackers from finding emails that are already registered?

It seems common practice to not positively indicate during a password reset attempt whether the email requested is actually registered or not. This makes sense because knowing that an email is registered will give an attacker a potential vector for exploit. However - how does one do this during the new account registration process? I cannot create an account for an email that already exists, I can merely tell the user that they already have an account and they did they mean to log in instead (etc). Obviously this exposes the fact that the given email is already registered. Is there any clever way to prevent this? Am I overthinking this?

May 11, 2025 - 11:43

It seems common practice to not positively indicate during a password reset attempt whether the email requested is actually registered or not. This makes sense because knowing that an email is registered will give an attacker a potential vector for exploit.

However - how does one do this during the new account registration process? I cannot create an account for an email that already exists, I can merely tell the user that they already have an account and they did they mean to log in instead (etc).

Obviously this exposes the fact that the given email is already registered. Is there any clever way to prevent this? Am I overthinking this?