电子邮件验证的隐私问题
我目前正在开发一个小型网站，我的客户非常关心隐私问题。
我正在使用常见的电子邮件验证来实现用户注册，即当用户想要注册时，他需要提供一个电子邮件地址，并且包含验证链接的电子邮件将发送到该地址。
在注册表中，我正在执行通常的表单验证。如果用户名（可以自由选择）已被使用，则会显示一条消息说明这一点。我的第一个想法是对电子邮件地址执行相同的操作，因为该地址在整个系统中也应该是唯一的。
但在某些情况下，即使某人在该网站注册的信息也可能是私人的。但现在，如果有人想知道其他人是否注册，以及他是否知道其他人的电子邮件，他可以简单地尝试使用这个已知地址注册一个新用户，错误消息会告诉他这个人是已经注册了。
我有一个想法如何解决这个问题（我将其作为自我答案发布），但我想知道，1）这个解决方案是否有任何其他缺陷，2）这种情况是否还有其他可能的解决方案。
谢谢。
I'm currently working on a small website and my customer is very concerned with privacy issues.
I'm implementing a user registration with common email verification, i.e. when a user wants to register he needs to provide an email address and an email containing a verification link is sent to this address.
In the registration form, I'm doing the usual form validation. If the username - which can be chosen freely - is already in use, a message is displayed saying so. My first thought was to do the same for the email address, because this one also should be unique across the system.
But under some circumstances, even the information if some person is registered at the site might be private. But now, if someone would like to know if some other person is registered and if he would know that other person's email, he could simply try to register a new user with this known address and the error message would tell him that this other person is already registered.
I have one idea how to solve this (I will post it as self-answer) but I would like to know, if 1) this solution has any other flaws and 2) if there are other possible solutions for this situation.
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
所以这就是我想到的解决方案。如果您发现任何问题，请发表评论:)
如果新用户使用现有的电子邮件地址，我将仅显示“正常”成功消息，说明带有链接的电子邮件已发送到给定地址。
然后会向该地址发送一封电子邮件，说明有人尝试使用该地址注册新用户，该地址已被使用，并且只能使用一次（基本上，验证错误消息只会发送到该电子邮件地址而不是网络浏览器）。
So this is the solution I've thought of. Please comment if you detect any problems with it :)
If a new user uses an existing email address, I will simply display the "normal" success message saying that a email with the link has been sent to the given address.
Then an email would be sent to this address saying, that someone tried to register a new user with this address, that this address is already in use and can only be used once (basically, the validation error message will only be sent to the email address and not to the web browser).
您是否考虑过选择根本不处理它？
有许多 ID 提供商；使用与 Stack Exchange 系列网站类似的方法可能更适合您的情况。
将 ID 管理委托给外部提供商非常简单，而且比自己处理密码、电子邮件、用户唯一性等更安全。
此外，大多数 ID 提供商将允许您访问注册用户的电子邮件地址，因此这不太可能成为问题。
Have you considered choosing to not deal with it at all?
There are a number of ID providers about; and using a similar method to the Stack Exchange family of sites might be more appropriate for your case.
Relegating ID management to an external provider is quite easy, and is easily more secure than having to deal with passwords, emails, user uniqueness, etc. yourself.
Additionally, most ID providers will allow you to access the registered user's email address, so that's not likely to be a concern.