✅ اگر ایمیل درست باشه، پیام میده: ایمیل بازیابی رمز به ایمیل شما ارسال شد.
❌ اگر اشتباه باشه میگه: ایمیل وارد شده ثبت نشده. لطفا ایمیل صحیح را وارد کنید.
خب مشکل کجاست؟ من اگر یه برنامه بنویسم که خودکار ایمیلای مختلف رو چک کنه، می‌تونم بفهمم کیا توی سیستم ثبت‌نام کردن و کیا نکردن 🌝 و اینطوری دیتابیس ثبت‌نام کنندگان رو در میارم :)
اینجاست که کتاب Cryptography Engineering میگه:
Errors need very careful handling, as they are a potential avenue of attack. The safest procedure is not to send any reply to an error and immediately delete the protocol state. This minimizes the amount of information the attacker can get about the protocol.
Unfortunately, it makes for an unfriendly system, as there is no indication of the error. To make systems usable, you often need to add error messages of some sort. If you can get away with it, don’t send an error message to the other parties in the protocol. Log an error message on a secure log so the system administrator can diagnose the problem. If you must send an error message, make it as uninformative as possible. A simple “There was an error’” message is often sufficient.
Src: Cryptography Engineering
Design Principles and Practical Applications, Niels Ferguson, Bruce Schneier, and Tadayoshi Kohno