Return to Answer

In the first case (I get a message telling the email is not recognized), it's a security concern. One can brute-force the form with a list of emails and know which of them are in the system indirectly. Given the same list of emails, and a bunch of sites whose forms act in the same way, you can correlate, and infer user behavior. That's not good for privacy.

The second case (I get a message telling me that if that email is registered, it will receive a password link) is a security feature. A reset email acts as a confirmation whether or not the owner initiated a reset by assuming that the owner has sole access the email tied with the account. If they didn't, they can choose to ignore the email.

In addition, the password reset form will always say it will send the email containing the reset link, regardless if the email was present in the system. This is to avoid giving an indirect indication of its presence.

Well, why not just sign me up when I do that?

It only makes sense when the email isn't in the system. Why would you show a signup form with an email that's already used? This also means that form will have to make a determination when to show a sign up form based on the existence of the email. This makes it no different from the first case mentioned above.

In the first case (I get a message telling the email is not recognized), it's a security concern. One can brute-force the form with a list of emails and know which of them are in the system indirectly. Given the same list of emails, and a bunch of sites whose forms act in the same way, you can correlate, and infer user behavior. That's not good for privacy. That's why password reset forms nowadays will "always "succeed" regardless of the presence of the email in the system to avoid this.

The second case (I get a message telling me that if that email is registered, it will receive a password link) is a security feature. A reset email acts as a confirmation whether or not the owner initiated a reset by sending the next phase of the reset to a location only the owner knows. This assumes that the email wasn't compromised as well.

Well, why not just sign me up when I do that?

It only makes sense when the email isn't in the system. Why would you show a signup form with an email that's already used? This also means that form will have to make a determination when to show a sign up form based on the existence of the email. This makes it no different from the first case mentioned above.

In the first case (I get a message telling the email is not recognized), it's a security concern. One can brute-force the form with a list of emails and know which of them are in the system indirectly. Given the same list of emails, and a bunch of sites whose forms act in the same way, you can correlate, and infer user behavior. That's not good for privacy.

The second case (I get a message telling me that if that email is registered, it will receive a password link) is a security feature as well. Most likely the form told you, regardless of existence of the email, that it will send an email to the email address to prevent the case mentioned above. It avoided giving indications whether or not the email was present.

Granting that the email isn't compromised, only the real owner of the account whose email is tied to can read the reset email. It also acts as a confirmation whether or not the real owner of the account initiated a reset. If they didn't, they can choose to ignore the email.

Well, why not just sign me up when I do that?

It only makes sense when the email isn't in the system. Why would you show a signup form with an email that's already used? This also means that form will have to make a determination when to show a sign up form based on the existence of the email. This makes it no different from the first case mentioned above.

In the first case (I get a message telling the email is not recognized), it's a security concern. One can brute-force the form with a list of emails and know which of them are in the system indirectly. Given the same list of emails, and a bunch of sites whose forms act in the same way, you can correlate, and infer user behavior. That's not good for privacy.

The second case (I get a message telling me that if that email is registered, it will receive a password link) is a security feature. A reset email acts as a confirmation whether or not the owner initiated a reset by assuming that the owner has sole access the email tied with the account. If they didn't, they can choose to ignore the email.

In addition, the password reset form will always say it will send the email containing the reset link, regardless if the email was present in the system. This is to avoid giving an indirect indication of its presence.

Well, why not just sign me up when I do that?

It only makes sense when the email isn't in the system. Why would you show a signup form with an email that's already used? This also means that form will have to make a determination when to show a sign up form based on the existence of the email. This makes it no different from the first case mentioned above.

In the first case (I get a message telling the email is not recognized), it's a security concern. One can brute-force the form with a list of emails and know which of them are in the system. Given the same list of emails, and a bunch of sites whose forms act in the same way, you can correlate, and infer user behavior. That's not good for privacy.

The second case (I get a message telling me that if that email is registered, it will receive a password link) is a security feature as well. Most likely the form told you, regardless of existence of the email, that it will send an email to the email address to prevent the case mentioned above.

Granting that the email isn't compromised, only the real owner of the account whose email is tied to can read the reset email. It also acts as a confirmation whether or not the real owner of the account initiated a reset. If they didn't, they can choose to ignore the email.

Well, why not just sign me up when I do that?

It only makes sense when the email isn't in the system. Why would you show a signup form with an email that's already used? This also means that form will have to make a determination when to show a sign up form based on the existence of the email. This makes it no different from the first case mentioned above.

In the first case (I get a message telling the email is not recognized), it's a security concern. One can brute-force the form with a list of emails and know which of them are in the system indirectly. Given the same list of emails, and a bunch of sites whose forms act in the same way, you can correlate, and infer user behavior. That's not good for privacy.

The second case (I get a message telling me that if that email is registered, it will receive a password link) is a security feature as well. Most likely the form told you, regardless of existence of the email, that it will send an email to the email address to prevent the case mentioned above. It avoided giving indications whether or not the email was present.

Granting that the email isn't compromised, only the real owner of the account whose email is tied to can read the reset email. It also acts as a confirmation whether or not the real owner of the account initiated a reset. If they didn't, they can choose to ignore the email.

Well, why not just sign me up when I do that?

It only makes sense when the email isn't in the system. Why would you show a signup form with an email that's already used? This also means that form will have to make a determination when to show a sign up form based on the existence of the email. This makes it no different from the first case mentioned above.