40

I see there are number of questions available there about approach for confirming email address with pretty good answers. I have a similar question I can think of two approaches for confirming email address:

  1. Sending confirmation link on the user provided email address, by clicking this link a new page will open showing user account confirmation message.

  2. Another approach is instead of providing confirmation link, provide user with the verification code in the email, let's say number 12345 is verification code, then user will read this number and enter it on the Confirmation page.

It would be great if you could provide your views for the above-mentioned approach. I agree that option #2 seems to add a bit of overhead however my priority is for security.

The mobile application integrates with my existing web application (I have developed APIs for it). The mobile application uses those APIs to get data from the web application. Now using the register API, the mobile app can register the user. For registration, the user's email address and password is required. I want to confirm the user's email address before giving him full access to the application. If user's email address is confirmed then he can use all options otherwise user is restricted to certain options. To confirm the email address, should I:

  1. Send the verification link to the user provided email address

  2. Send verification code in the email which user can enter on "verify account" page in mobile app

  3. Send deep link + verification code in the email so that when user click on deep link automatically mobile app will get launched with the verification page being open where user can type in (or copy+paste) the verification code

I want to know which is one better approach from usability point view and security point of view (my preference is for security).

Improve this question
9
  • I would include a concise explanation of the context in which you are doing the verification (mobile native application) so to clarify the question and get more feedback.
    – Okavango
    Dec 30, 2014 at 13:40
  • @Okavango added the explanation for the mobile application for which I am looking to implement verify email address functionality
    – Rahul
    Dec 30, 2014 at 14:32
  • Have you explored social media login? This might allow you to authenticate users and verify emails.
    – Okavango
    Dec 30, 2014 at 18:51
  • My mobile app allows login with fb and g+ also we allow user to sign up with email id and this is where I want to confirm email address. I guess we don't have to validate email address if user sign up with social media login
    – Rahul
    Dec 30, 2014 at 19:11
  • 1
    Rahul, I have asked the question on the information security site and feedback could be found here
    – Okavango
    Dec 31, 2014 at 9:54

3 Answers 3

Reset to default
16

This will largely depend on what the verification entails in terms of user access.

Option 1

I would say that (option 2) sending a verification code is more secure as users will have to input their verification code before the verification is complete, particularly if this is part of login ( 2 step verification).

Option 2

This being said if the verification happens once users have logged in ( Option 1 ) sending a link would be more viable as user is already logged in.

In both cases ensure that the link or verification code have a defined validity time and that the user is made aware of it. Also account for users not being able to view email, by advising them to check their spam folder and/or whitelist sender.

Update: Given the flurry of comments around this answer, I have made a an update that should hopefully clarify some of the misunderstandings and assumptions.

Clicking on a link to verify email is definitely more user-friendly than typing a code which is the point I have tried to make in my answer (option 2). Both these can be combined to optimise as suggested by some of the answers and comments below. However from a UX perspective, this is not a blanket rule there are other factors and aspects that need to be taken into consideration.

If the verification happens as part of an authentication process, for example password reset or recovery, then a combined link and code will work. This being said, you need to consider carefully the type and scope of user information held within the system.

Sites that request sensitive or Personally Identifiable Information should be, and feel, secure. If a site doesn't feel secure, the user will be dis-incentivized to use the site. The user will be more likely to distrust the site, which will build barriers between the user and requests to provide PII or to provide access to sensitive information .

There is a great deal of expectations from both clients and direct users when it comes to authentication; some systems are perceived as more secure just by virtue of visual design and their overall workflow. You need to make sure that your authentication process is not only secure but also perceived as such by users and stakeholders. So better understanding of how your end users perceive security and which interaction patterns and workflows they are most familiar with is key. This is particularly true for corporate and enterprise solutions that generally hold much more information than retail websites for example.

Overall I would say that based on assessing the factors above, if asking users for a code will boost or maintain user confidence in your site or app while fulfilling the task than by all means go for it. The argument also applies to using a link with code if it does not jeopardize user confidence.

I have also found that

Understanding user perceptions of transparent authentication on a mobile device

very insightful! Good luck!

Improve this answer
12
  • 18
    "sending a verification code is more secure", you assert, but you offer no justification for this claim. It seems clearly false to me. Either approach - link or code - simply validates that the user controls the email address by sending them a secret and having them send it back to the web server. They are as vulnerable as each other to brute force, or to an attacker who has illicit access to the user's emails. They can both be performed by a bot. So what possible security difference is there?
    – Mark Amery
    Dec 25, 2014 at 17:11
  • 7
    @Okavango "the code is still more secure because it requires further action from user before granting access." Again, you're just making assertions without even trying to justify them. Just because you require an additional arbitrary action from the user does not mean your system is more secure. It is absurd to suggest that baking a secret key into a link the user clicks is somehow less secure than having the user type the same secret out by hand. I mention eavesdropping and brute force merely as examples of potential attacks that both these approaches are be equally vulerable to.
    – Mark Amery
    Dec 25, 2014 at 19:24
  • 7
    @Okavango the burden here is on you to explain why requiring the user to perform an act with a clumsy UI (sending the secret to the server, by typing it) is magically more secure than them performing effectively the same action with an easier UI (by baking the secret into a link). What attack could conceivably work against the secret-in-a-link system but not against the type-the-secret-by-hand system? If there is truly a security difference, you will be able to describe such an attack. But you won't be able to, because there is no difference.
    – Mark Amery
    Dec 25, 2014 at 19:27
  • 4
    "I don't think system security is the focus of the question" - then why have you written an answer that revolves around security? Security is your entire reason for advocating that the user types in a code instead of clicking a link.
    – Mark Amery
    Dec 25, 2014 at 19:50
  • 6
    I'm sorry, but this answer is wrong from both the security perspective and the UX perspective. @MarkAmery here nailed it. I don't have the reputation to downvote, but be sure I would have had I could.
    – Madara's Ghost
    Dec 29, 2014 at 11:09
12

It has absolutely no effect on security. Use both for maximized UX.

If your priority is security, either one is fine. The purpose of the procedure is not to add a layer of security to your application, it's to verify that indeed the user has control over the email address he claims to be his.

Email is insecure by default, your secret can leak no matter what you do in this approach. The only way would be to encrypt the mail, but that incurs heavy heavy UX penalties.

Since you asked this on a UX site, I will answer from the UX perspective as well.

Clicking a link is simpler than typing (who am I kidding, copy pasting) a verification code into an input box.

Some mail clients do not support links, so make sure to also include the code in the email message and have a page ready to accept verification codes through an input box as well.

Improve this answer
2
  • 1
    An alternative is just have the link plus instructions saying "To finish registration, click the link above or copy and paste it into your browser's URL bar." There's not much difference between these approaches that I can see. Your way benefits tech-illiterate people who don't know how to copy and paste on the device they're on, or don't know what a "URL bar" is. On the other hand, it risks confusing users ("I've clicked the link, but I think there was a code, too? What do I have to do with that?"), especially if the email is not in their first language.
    – Mark Amery
    Dec 29, 2014 at 11:28
  • Clear instructions is assumed (this is User Experience, after all). Feel free to add it to the answer, as I am short on time (and from mobile, so it's a pain)
    – Madara's Ghost
    Dec 29, 2014 at 11:58
2

I agree with Okavango, and this is a continuation of his answer.

Different clients: Say your user is on the mobile app; that way it's more easier for him to enter a code and get on with his business. Whereas if it's a link, the process is: Register in app> email(to get link)> browser(for link verification)> open app for re-login.

I'm going a step further and would suggest that instead of sending an email, send a text message with the verification code. google does this

conclusion:

Pros of code over link:

  1. Security
  2. Make usability easier when using a client other than a browser
  3. Forced to manually type the code rather than copy the link > increases security

Pros of text message over email:

  1. Not always connected to Internet
  2. User ALWAYS has his phone
Improve this answer
12
  • 6
    "Forced to manually type the code rather than copy it > increases security" - how? I don't see any reason why this should be true.
    – Mark Amery
    Dec 25, 2014 at 17:22
  • 2
    @Mark Amerly, I will make an attempt to explain security vulnerability associated with "verification link" approach as I am the one who posted the question for the mobile application I am buidling on. Here are the scenarios: with Verification link: Let's say the attacker somehow gains the access to user email account, now he can verify the account by clicking the verification link from the email.
    – Rahul
    Dec 26, 2014 at 6:36
  • 2
    continued: with the verification code in email: Let's say the attacker somehow has gained access to user email and retrieves the "verification code" from the email. Now even though he has verification code he won't be able to "verify account" because for verification he will have to sign in to my mobile application then go to verify account screen and enter the "verification code" clearly here attacker only has the "verification code" and not the sign in details for application hence making it bit secure against "verification link" approach
    – Rahul
    Dec 26, 2014 at 6:37
  • 7
    @Rahul your argument depends upon the user needing to be logged in to verify by code, but not needing to be logged in to verify by link. There's no reason this needs to be the case; if the code worked without login, but the link demanded that the user logged in when visited while unauthenticated, then the opposite argument would apply. It's not really a link vs. code difference - you're just making an unstated assumption that the code approach requires authentication and the link approach does not.
    – Mark Amery
    Dec 26, 2014 at 15:20
  • 2
    @Mark remember my application is mobile native application it won't be accessible through browser hence for link approach user will be unauthenticated. Its common approach to allow authenticated users to do certain things like enter verification code, change password, etc. It doesn't make sense to me to allow verification code entering without login when you are entering code through app only
    – Rahul
    Dec 27, 2014 at 5:17

Not the answer you're looking for? Browse other questions tagged or ask your own question.