7

I have been thinking about whether to implement email verification feature in my app for a while. I want to let users login even if they do not have a verified email. If the real owner of that email wanted to create an account and see that the email is already used then that person can always request a password reset link, so there should not be a problem. Although I don't see a point in asking to verify email accounts, I am feel like I am missing something important here. What is point of email verification in this scenario?

  • @ShahinMursalov Security ;) – Kristiyan Lukanov Aug 16 '17 at 15:41
  • 1
    @KristiyanLukanov Why do you think it is more secure? Please explain your answer. If someone has chosen a fake email then that means they don't care about security. – user105695 Aug 16 '17 at 15:48
10

Essentially, what it comes down to... is are you dealing with USERS or PEOPLE on your site.

Most companies prefer to have a relationship with a person. Exceptions would be reddit and other sites which are designed with anonymity in mind and are almost purely online communities.

  1. A verified email is a verified person behind the email. Prevents some simple bots
  2. A verified email can reduce a person's frustration if the email was typed in wrong. If a user joined some music service, made a bunch of playlists and then logged out and forgot the password... it would be helpful if they could reset their password properly.
  3. A verified email is higher value for marketing purposes. You know that the email is not fake and a dead end. You can analyze the users's habits and target them specifically based on their browsing habits.
  4. A verified email allows you to contact a person about security breaches or other important site issues, site announcements.
  5. A verified email prevents abuse. I constantly receive spam and information from sites I never signed up for because there are several people with my name who either sign up for services and mistype their email address or they're signing up for some random hook-up site that doesn't require a verification (for obvious reasons). If these sites verified emails, I would get an email asking for verification and promptly ignore it.
  • This was the answer I have been looking for. Especially the last point. – user105695 Aug 16 '17 at 21:20
7

Alan George covered the main reasons you should verify emails but I just wanted to touch on this point in your question.

If the real owner of that email wanted to create an account and see that the email is already used then that person can always request a password reset link, so there should not be a problem.

That is a HUGE problem. Under no circumstance should you be able to hijack another persons account, even if it's your email. The other person may not even have maliciously/intentionally used your email it could've been a type. If that person has any personal information, post history, contacts, and god forbid financial information its a serious privacy and potentially legal concern to be able to take over that account from an unverified email.

If this account has any paid subscriptions or in-app purchases then that is going to be one very upset user if all of a sudden they try to log in and it's gone. Even if the account has nothing of monetary value it could have a ton of time invested, like if the app is a game and they spent thier time progressing just to lose the account. I know if someone took over my account here after years of building my reputation I'd be furious.

  • I see your point, but I can't think of a workaround for this problem. Lets say I had a typo in my email and then the real owner of that email clicked on the reset my password button. How can the administration possibly know whether the one who clicked on the reset button is the same person who created the account or not? PS: Instagram does the same thing. – user105695 Aug 16 '17 at 17:43
  • 1
    @ShahinMursalov that's the entire point of email verification. When the account is created it is verified at that email address, when the password reset link is sent to that email address you can be sure the person receiving it is the same person that created the account. I do not have an Instagram though so I cannot vouch for how they do it. – DasBeasto Aug 16 '17 at 17:59
  • If I had a typo, then the confirmation email would be sent to wrong email as well, so the other person can confirm the account and then reset the password. – user105695 Aug 16 '17 at 18:01
  • 2
    @ShahinMursalov If you had a typo when registering, then yes the person who owns the email could verify the account and change the password but at that point you'd only lose a blank account tied to the wrong email, no harm (don't let people use an account until they verify). If you have a typo at the point of resetting your password yes an email would be sent to the wrong person but it would be to reset their password not yours, so no security implications there. – DasBeasto Aug 16 '17 at 18:05
  • (don't let people use an account until they verify). The problem is I intend to let them use the account even if they have not verified yet. Anyway I see what you are trying to tell and I think you are correct in that context. – user105695 Aug 16 '17 at 18:29
5

There are a number of reasons.

Security

  • Requiring users to verify their email assists in preventing spam registration. It is an extra step, and also requires access to many email accounts.

I designed a personal website many years ago and didn't require email registration, because I did not expect very many people to use it. I left it dormant for a while, and came back to find many of my posts riddled with spam comment ads for the darker aspects of the internet.

  • If a user forgets their username or password, a verified email is often the easiest method for recovery.

If you make a typo in your email address when registering or don't in fact have access to it, you may not be able to recover your website account.

Contact/Marketing

  • Having a known accessible email to contact users at is desirable for companies.

Naturally, from a user perspective marketing material is undesirable. From a company perspective, however, it is very desirable to pass along information to verified user emails.

Important account notifications require a verified email, such as suspicious activity or priority messages. Imagine signing up for online banking and fraud alerts are being sent to a non-existent email.

Alternatives

There are some cases where email verification may not be immediately (or at all) necessary.

  • Allowing limited features until email is verified
  • One-time registration, such as completing a transaction
  • Sign-up forms for events or accounts where other contact information is provided (such as a phone number)
  • Allow registration with other accounts that have verified email addresses (Facebook, Google, LinkedIn)
  • When an email adress is required why would a person supply their own email? And if you use verification, why not something like spam.la or other throw away email accounts? Which often means that it can be read by anyone on the net, and thus lowers security. – Hennes Aug 16 '17 at 16:42
  • Yes, temp/throwaway emails will allow users to get past email registration. The difference is between putting a fence (verification) around your neighborhood (website) or nothing at all. You will at least fend off most automated spam bots attempting to register anywhere they can. – Alan Aug 16 '17 at 17:16
  • I am not asking for email verification to login. Users can login even if they do not have verified email accounts. So I do not see how this will prevent spam accounts. – user105695 Aug 16 '17 at 17:49
  • I don't understand your dilemma. If you have no verification like your current system, you are opening the gates to spam bots. If you have at least some form of email verification, you will at least prevent the low-level attempts, and gain the benefits I listed in my answer. If the wrong email is provided, typically a user will have to still log in before it's associated with their account. – Alan Aug 16 '17 at 18:06
1

In the first place you are trying to secure the form input to your site. Secondly, everybody wants to talk to people and avoid spam emails, incorrect form entries and other key aspects that could potentially harm the account creations or even disrupt the ordering process.

First (5-10 years ago) validation processes targeted mostly domain validation, entry validation example@brand.domain and other key aspects like ip validation to exclude multiple subscriptions.

From a programmers point of view these validations (and others about the security part) are enough. But, and there is a big but, other departments like marketing, sales and so on that need other types of email validation.

I usually recommend integration with different API's in order to exclude and separate possible spam traps, emails known to be abusive with spam marking and so on, validation procedures that are good mainly for marketing departments.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy