从登录/注册/忘记表单中收集电子邮件是否是一个真正值得关注的问题？
我正在构建一个以电子邮件地址为键的会员系统。即电子邮件/密码。
当我这样做时，我的脑海里总是有一个令人烦恼的担忧，即垃圾邮件发送者会机器人我的表单并使用它们以某种方式验证电子邮件地址。
例如，如果我在注册表上放置一个ajax电子邮件检查器，它会关闭并询问服务器我们是否已经存档了此电子邮件地址，我想有人可能会轻而易举地向其扔电子邮件地址并记下返回 true/false 的电子邮件地址，然后将这些信息用于自己的邪恶目的。
另一个例子，对于忘记密码例程，而不是不置可否的“我们可能会或可能不会存档该电子邮件地址”，最好告诉真实用户我们确实在档案中找到了他们的电子邮件并向他们发送了密码。但我再次担心坏人会提交大量电子邮件地址并使用+/-响应来达到自己的目的。
第三个示例，登录表单对错误密码或未知电子邮件地址的反应方式也可能会提示该电子邮件地址是否是已知且活跃的用户。
这是我真正应该担心的事情吗？或者我只是让我的用户和我自己的生活变得困难？
I'm building a membership system keyed by email address. I.e. Email/password.
As I do it there is always this niggling concern in the back of my mind that a spammer is going to bot my forms and use them to verify email addresses somehow.
For example, if I put an ajax email checker on the registration form which goes off and asks the server if we have this email address on file already, I envisage someone might trivially throw email addresses at it and take note of the ones which return true/false, then go off and use that information for their own evil purposes.
Another example, for the forgot password routine, rather than a non-committal 'We may or may not have that email address on file' it is nice to tell the genuine user that we really did find their email on file and sent them their password. But again I worry about bad people submitting lots of email addresses and using the +/- response for their own purposes.
Third example, the way the login form reacts to bad passwords or unknown email addresses also can throw off hints as to whether the email address is a known and active user, or not.
Is this something I should actually worry about? Or am I just making life hard for my users and myself?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
是的，您应该担心，即使您的电子邮件数量比 FB 少，您的用户的安全也是您的责任。不要让放纵的态度阻止您为您的网站和用户寻求最佳的安全性。
Yes you should be concerned, even if you have a few emails in comparison to FB the security of your users is your responsibility. Don't let laxadasical attitudes deter you from seeking the best security you can find for your site and users.
您认为您的系统中会包含世界上很大一部分电子邮件地址吗？如果没有，那么我认为这不是一个问题。
Do you think you're going to have a significant proportion of the world's email addresses in your system? If not, then I don't think this is a concern.
Facebook 可能需要担心这个问题，而不是你。您只拥有世界上电子邮件地址的一小部分，因此使用您的数据库来检查地址将是徒劳的。
Facebook might need to worry about this, not you. You will only have a tiny insignificant fraction of the world's email addresses, so using your db to check addresses will be futile.