Sorry, I was not able to formulate the title shorter.
Today I stumbled across the password recovery from Dropbox. Here, users have to enter their email address and Dropbox says:
If a Dropbox account exists for [email protected], an e-mail will be sent with further instructions.
But what is the reason behind this? First, I thought they try to prevent attackers from randomly guessing email addresses and checking whether they are registered or not. Imagine you know that [email protected] is registered to, e.g., craigslist. This might be a great privacy issue in some cases.
But then I remembered that your email is checked against all existing email addresses when a new account is registered.
So, what is the reason behind this behavior?