3

In a project I'm working on, there's a service website where customers can register objects they own in order to use the service. If a customer owns many of these objects, all can be registered on the same account so they can all use the service.

If a customer tries to register a new account for an object and they already have an account, I would like to give them the option to add it to their existing account in order to reduce the number of duplicate accounts.

Let's say after the first step of the registration process, the system determines that this object is owned by someone who already has an account.

My client is pushing for a confirmation screen that informs the customer of an existing account and gives them the option to add it to that account without authentication. This essentially allows anyone with enough information to be able to add an object to a persons account without authentication.

My preference would be that user should verify that it's their account (by logging in) before adding objects to an account.

Are there standards or best practices around account management and privacy that I can share with my client?

  • 1
    Welcome to the site! You may want to try cross-posting on security.stackexchange.com. Answers here will consider the value to the user of logging in vs not. Answerers there may be more familiar with ethics codes and standards relating to security. – Graham Herrli Aug 22 '14 at 18:12
  • What is more likely: a user creates more than one account, or someone tries registering a stolen object? – Nathan Rabe Aug 22 '14 at 19:05
  • 1
    If you do recognize them, (perhaps by phone number) be sure to not offer more information (like address) unless they have authenticated themselves. Also, the ability to add items to an account without authentication leads to security flaws. – John Deters Aug 22 '14 at 19:53
  • Example: I add Item 1, then Item 2. I then call customer service and say "I forgot my password, but you know it's me because I bought Items 1 & 2 yesterday, can you please reset it to VICTIM#1? Thanks. " – John Deters Aug 22 '14 at 19:56
  • The more likely scenario is the happy scenario of user logs in, user adds object. In this particular case, the consequences of adding this object is minimal because there's enough information to determine that the owner of object 1 is the owner of object 2. If the user is not the owner of the object, and they happen to know enough information, the worst that could happen is that the owner now has both objects that they own. – black_rider88 Aug 22 '14 at 19:58
1

I think you should have authentication because you aren't losing anything with it there, but can lose a lot without it.

UX wise, that's a good idea because it will allow users to feel safer with that functionality in place, which ultimately increases your security which also enables user trust.

To implement it, it could be as simple as:

mockup

download bmml source – Wireframes created with Balsamiq Mockups

Obviously visual treatment could vary, and depending on what your developers (or your security team) say if this is secure enough to implement.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.