New Account, change Duplicate E-mail error

Question

I run a drupal / civicrm build for a non-profit. We are very careful with our members information, and want to make sure that no one trying to, would be able to figure out if someone they knew was a registered user.

The problem we have is when someone goes to create a new user account, if they use an e-mail that is already on our site, they get an error message saying that they can't use that e-mail because it's already registered on the site.

There are plenty of people - bosses, spouses, etc who could be testing an e-mail address to see if someone they know is on our site, and this error message pretty much confirms it.

Is it possible to change the error message to something else? We have the e-mail confirmation enabled, why can't it say, "An e-mail has been sent to [email protected] with your login information?"

Answer 1

You can do a couple of things. One, I would advise installing the Username Enumeration Prevention module:

https://www.drupal.org/project/username_enumeration_prevention

This will stop forgot password form abuse.

Secondly, hiding this fact on the registration side is hard. You can't have duplicate email or usernames in Drupal (not easily), and if you get an error on that then it is pretty apparent it is already in use. Giving a vague error here could also confuse actual users who are trying to register.