My site needs users to register with email addresses that are not freely available, like company or university email addresses. When users register, they get sent an email containing a link to click on so that we know the address is valid at that time. However, after a while, people are going to move companies, leave university etc. I would like to ensure that these email addresses are kept up to date. How can I do that whilst being as least annoying as I can? (eg every X months I could send an email saying please verify this is still your email address, but it seems fraught with danger.)
2
-
Suppose user sends you verification reply. Could you please clarify how you use it? Just to set mark in database? Also, what if user don't send you verification but still owns the address? And what if you receive verification but user doesn't own the address in fact?– SergCommented Jul 24, 2020 at 16:17
-
@Serg If a user doesn't send a verification reply, they don't get to use the fancy stuff on the website, just the freely available stuff. So, when they do send a reply then yes, we mark that in a database. If user doesn't own the address (eg they've borrowed someone else's email account), then I'm not sure what we can do about that. Except if we asked them to verify their email regularly, it would be harder to ask a favour from a friend to borrow their account (because the friend would get fed up of it).– MatthewCommented Jul 27, 2020 at 9:34
Add a comment
|
3 Answers
You could think about changing your login method to mailing people magic links to login (and abolishing passwords in the process). This way you always know that the email address is in use as they would have to use it to login.
-
That does give me an idea - 2 factor authorisation. The hosting company my site runs on sometimes sends me a code that I have to type in to log in.– MatthewCommented Jul 28, 2020 at 7:32
Verify the email address every time you send something to the user at that address. For example, Airbnb will validate an address each time it sends a booking confirmation or receipt to an address, and prompt the user if the address bounces back.
answered Jul 24, 2020 at 16:25
-
Thank you. Unfortunately, in five years, we have only once sent an email to our users.– MatthewCommented Jul 27, 2020 at 9:30
-
1That's interesting. What is the business need to continually ensure that the user's email is up-to-date if the system is not sending anything to it? Commented Jul 27, 2020 at 15:20
-
It has to be an email address that is not freely available such as a company or university address, which allows the user to be identified. We have commercial partners who want some control over who is accessing their IP.– MatthewCommented Jul 28, 2020 at 7:30
-
1Got it. It sounds like your users know that they need to be affiliated, so suspension wouldn't necessarily be a surprise. Your idea to send an email every few months seems like a good solution -- could it be once a year? Perhaps you give the user 30 days after the email is sent to respond and if it hard-bounces, or there is no response, the account goes into a suspended state. You could put a message in their post-login UI that they need to respond to the email to stay active. Commented Jul 29, 2020 at 1:04
According to your reply to my comment I think the best way will be to ask for email verification just at the moment when user wants to access protected staff on your website. When user clicks access button you may warn him to make sure that his registered email is still valid. In this case you don't need to send verification email but just ask question using dialog. If user really wants the staff he either will go to his profile and change email or will use current email.
Asking for periodical email verification looks like asking client to visit a shop each month for verification his loyalty card to get free Christmas cake.
-
But would anything happen if the email address wasn't valid? If users learn that they can access protected information whether or not the address was valid, wouldn't they start ignoring the prompt? Commented Jul 27, 2020 at 15:24
-
@StacyH First let me say that I like your answer - it is very close to mine but differs in some detailes. We both can discuss them but we both make many assumptions about task context, and only author views all picture. In fact he can compile his solution from different answers. He need to take in mind many circumstances. E.g. if user currently doesn't own email would he like somebody else receive verification message (privacy)? Or is free staff expensive enough for its author to strictly control access to it? And so on.– SergCommented Jul 27, 2020 at 16:33