Is email harvesting from login/signup/forgot forms a genuine concern?

Question

I'm building a membership system keyed by email address. I.e. Email/password.

As I do it there is always this niggling concern in the back of my mind that a spammer is going to bot my forms and use them to verify email addresses somehow.

For example, if I put an ajax email checker on the registration form which goes off and asks the server if we have this email address on file already, I envisage someone might trivially throw email addresses at it and take note of the ones which return true/false, then go off and use that information for their own evil purposes.

Another example, for the forgot password routine, rather than a non-committal 'We may or may not have that email address on file' it is nice to tell the genuine user that we really did find their email on file and sent them their password. But again I worry about bad people submitting lots of email addresses and using the +/- response for their own purposes.

Third example, the way the login form reacts to bad passwords or unknown email addresses also can throw off hints as to whether the email address is a known and active user, or not.

Is this something I should actually worry about? Or am I just making life hard for my users and myself?

Answer 1

Do you think you're going to have a significant proportion of the world's email addresses in your system? If not, then I don't think this is a concern.

Answer 2

Facebook might need to worry about this, not you. You will only have a tiny insignificant fraction of the world's email addresses, so using your db to check addresses will be futile.