1) Validate email address. 5-10ms 2) Send a non-blocking request with a flag, eg "Good" "Bad". 3) Return message to user that email has been sent but can not

1) Validate email address. 5-10ms 2) Send a non-blocking request with a flag, eg "Good" "Bad". 3) Return message to user that email has been sent but can not confirm if the email is true for privacy reasons. While yes, it can be down to a timing attack, the trouble is that this vector can be used against sessions, logins, etc. It can be a standard that Mozilla should adopt.