More concrete example: Account enumeration because the "forgot password" page tells the user "Unable to find account [email protected]" instead of "If your account [email protected] exists, then we have now send you an e-mail to recover your account".

If your forgot password page takes longer to respond when an account exists when it does not, it is also a side-channel attack.