Should (and how should I) I use email addresses for login without validating them?

Question

So that users don't have to remember a username, my webapp doesn't ask users to enter one (accounts are private and there are no profiles or user-generated content). However, I would also prefer not to send users a confirmation email when they sign up, since I don't use their email addresses to send them things (except when they reset their password).

However, I recognise this could lead to problems if someone signs up with the wrong email and then the person that really owns wants to register. What is the best way to handle this?

Answer 1

My observation is it seems like you are trying to throw one stone at a lot of birds.

You mentioned you don't use the email address "except when they reset their password", you in fact mean you are using it and it is important that no user claim access to an email which they don't own. This should require an email validation.

You also mentioned you don't want users to have to remember a separate username from the email address, which seems like a worthwhile goal. You could try to integrate Oauth from other popular services like facebook or google as a way to reduce/simplify the process for some users, depending on their comfort level with shared sign-in.

Answer 2

Email addresses are normally validated to make sure that stuff can be sent to the user, if you never plan on sending anything then the email address really is just a username, usernames are very rarely validated.

All you need to do is have a confirm email address (username) input to attempt to account for typing/spelling errors which could occur with a single input and make sure that they input it correctly.

Perhaps displaying their email address somewhere discrete after their first login (which I'm assuming occurs automatically after they sign up), would allow them to spot a potential mistake and rectify it.

Answer 3

It sounds like you don't use emails for anything at all - so why ask for emails in the first place? Asking for a plain username gets around your validation requirements and also resolves the reservations of spam-phobic users.

If you only use for emails because you think re-using a familiar string is easier than creating a brand new name, you could just suggest it as part of the sign up form help text.