46

I am creating a free to use website without restricted registration. Part of registration includes validating the email address entered by clicking a link we send to that address. The unique identifier for each account is their chosen username.

Should multiple user accounts (potentially the same person with multiple accounts) be allowed to exist with exactly matching email addresses?

Improve this question
10
  • 5
    Depending on the site, also consider letting the user change their email address - hosts do go down. For this reason, it's better not to rely on the email as the account identifier even if it is unique.
    – Bob
    Mar 12, 2015 at 12:33
  • 5
    What is the target audience of the site? Lots of people who are not as technically adept share email addresses; do you consider preventing those from registering individual accounts to be acceptable? Because that is the flip side of Benny Skogberg's answer; by requiring each account to have a unique email address, you prevent people who share email addresses from having their own accounts.
    – user
    Mar 12, 2015 at 12:57
  • 3
    I guess the real question is why you want users to enter their email addresses. I can think of several purposes that do not require the email addres to be used just once.
    – Dennis Jaheruddin
    Mar 12, 2015 at 13:23
  • 8
    Many older couples only have only one email account between them. It is NOT unreasonable for multiple people, in some situations, to want to share a single email address but have separate user accounts.
    – ErikE
    Mar 12, 2015 at 21:01
  • 6
    Should a newspaper only allow 1 subscription per physical address?
    – bjb568
    Mar 13, 2015 at 2:14

5 Answers 5

Reset to default
73

No!

You can't send "forgotten password" links to a single account if you have the same e-mail address, unless the user specifies a unique username. But what happens if the user forgets the username as well? Then you need to reset password on all accounts associated with the e-mail address.

Improve this answer
17
  • 8
    Even when the user does specify a unique username, the "forgotten password" link will go to all users of the address. If the email is to be reasonably secure it cannot include the username ["A reset request was received..."], but what if more than one request is sent by different users at that email address? They will all get a link but none will know which is theirs. (This isn't a criticism of the answer, it's corroboration. +1)
    – Andrew Leach
    Mar 12, 2015 at 12:16
  • 5
    Actually you can send the link, you just need to send a mail containing all accounts. In fact, this is what stackexchange sites do if you both have an account with your mail address on that site, and are able to log in with your stackexchange account (that can have the same email address). --- Basically they just ask which one you want to reset.
    – Dennis Jaheruddin
    Mar 12, 2015 at 13:21
  • 20
    Personally I like those websites best who use the e-mail address as the login name, rather than a separate user name. This makes it blatantly obvious that the mail address is uniquely related to an account, and also does away with an easily-forgotten username.
    – Stefan Majewsky
    Mar 12, 2015 at 14:32
  • 2
    The usual way to recover accounts I've seen is "Request password reset email by entering username", and in case of forgotten username, "Request email with username by entering email address". If you support multiple accounts for an email address, the former stays the same and the latter only has to be modified to list all usernames associated with the account, if more than one.
    – Turch
    Mar 12, 2015 at 16:32
  • 7
    @StefanMajewsky Those same websites often lock in the email address such that you can never change it. This is a serious issue when the email address changes, and that happens quite often in the real world (see Dennis' comment on the question). Sometimes, it can be changed manually via the website's support channels, and sometimes it cannot be changed at all - the end result in all cases is massive inconvenience to the user.
    – Bob
    Mar 13, 2015 at 1:10
44

Yes!

There are no security problems. If two people share an email account, and one of them has an account on your site, either of them can reset the password on the account (since they both have access to the place where the "forgot username" and "forgot password" emails get sent). Both people have the ability to take control of the account, and that's their problem.

The only concerns are usability. We have 3 types of email accounts:

One site user / one email user: In either case, they are unaffected. Even if you have to support specialized emails (recover username for email with multiple accounts), a regular user will still get the same email with just their one username.

One site user / multiple email users: Again, unaffected in either case.

Multiple site users / multiple email users: If you don't support multiple accounts, only one user can have an account, so half the people will be in the above group and half of them will be unable to create an account (or if they really want to, they will probably create a throw-away account they will immediately lose).

If you do support multiple accounts, this group will need a special "Recover username" feature that sends all the usernames attached to the account, instead of just one. So recovering a username will be slightly less usable because they have to figure out which username is theirs, but significantly more usable because otherwise half of them can't create an account in the first place. In the (unlikely) scenario that both try to reset passwords close enough in time that they can't tell which email is for whom (say, within the same day), it does fall on the users to figure it out by re-requesting a password change email one at a time. But again, this only affects this subset of users, half of whom would not be able to have an account in the first place.

So, I don't think there is any UX reason to prevent multiple users for one email address. The only cost is the additional development time, which should be insignificant or very minor.

Improve this answer
8
  • 4
    Instead of a separate "Recover username" feature, clicking on the password reset link could lead to a page that lists all associated user names: select one user name (after which the password reset link invalidates) and enter a new password.
    – unor
    Mar 12, 2015 at 22:46
  • 2
    @HagenvonEitzen: No security problem (your second guess is correct): 1. In the "Password forgotten?" form you enter your email address. 2. You get an email with a password reset link. 3. Following this one-time link leads to a page where, in case of more than one user name, all user names are listed. 4. Selecting one user name allows you to reset the password for it.
    – unor
    Mar 13, 2015 at 21:34
  • 1
    "Too bad, it's your fault" is not good design. And it's absurd to say it's only their problem when this design choice is yours.
    – Matthew Read
    Mar 13, 2015 at 23:20
  • 4
    @MatthewRead: I think Turch is correct. The design choice is to allow users to share control over their account with someone else by using the same e-mail address. This may be desired. The design choice is not to force users to share control over their account; if they insist on being the only master over their account, they are free to use an e-mail address only they have access to. I'd call that added amount of flexibility good design.
    – O. R. Mapper
    Mar 15, 2015 at 10:10
  • 1
    @MatthewRead If you use an email address for account recovery, it is a master key to the account. If my friend knows my email login information, they can take control of most of my online accounts. The only way around that is to not make an email account the master key to the account. I'm simply saying that "one of the email users can hijack the other's account" is not a valid reason to not allow both of them to have accounts, because that could happen just as easily if you only allowed one to have an account - it's inherent to the "use email to recover account" system.
    – Turch
    Mar 17, 2015 at 13:13
11

I agree with Turch’s answer that allowing multiple user accounts per email address can be a good idea, but I don’t think that a 'less usable' 'special "Recover username"' feature is needed, and I don’t agree with Benny Skogberg’s reasoning that a password reset would require resetting all passwords.

Scenario: On Example.com, two accounts are registered with the email address [email protected], John2000 and Alice3000+. Now John forgot his password and his user name, he only remembers the email address. (It doesn’t matter if Alice3000+ is his account also, or if it’s the account of his partner and they are sharing an email address.)

  1. In the "Password forgotten?" form of Example.com, he enters [email protected].

  2. An email gets sent to [email protected]:

    Someone […] if it was you […] (… and so on)

    If you want to reset your password, follow this link:

    http://example.com/password-reset?t=23471192…3123123

  3. John visits this link (it now is invalidated, so doesn’t work for a second try) and the page says:

    Your email address has two accounts associated. Select the account you want to reset the password for:

    • Alice3000+
    • John2000

  4. John clicks on his account, John2000, and can enter a new password.

In step 3, the list could include additional information to identify/disambiguate the accounts (e.g., registration date, last activity, most popular contributions etc.).

Novice users that share an email address might not be aware of how websites work (i.e., that password resets exist and that someone else with access to the email account could reset the password and login under their name), so it might be a good idea to inform them about the risk as soon as they try to register a second account.

Improve this answer
5
  • This is not good security practice as it allows attackers to gain information that allows them to associate users with their email addrs.
    – bjb568
    May 20, 2015 at 14:32
  • @bjb568: How so? Someone entering someone else’s email address never learns if this email address is registered at all.
    – unor
    May 20, 2015 at 14:34
  • My thinking was that you could create an account with the same email then use it to look for other accounts. I guess the risk could be mitigated somewhat by requiring email confirmation, but users are dumb and could, I guess, just click the confirm button even if they didn't own that account.
    – bjb568
    May 20, 2015 at 16:48
  • 1
    @bjb568: Assuming that you register with someone else’s email address (and assuming the site does not require email confirmation), you wouldn’t be able to see that someone else (i.e., probably the owner of that email address) is using the same email address: If you enter the email address in the "Password forgotten" form, an email gets sent to that address … but you can’t read it (because you don’t control this email acc), only the email address owner can (who will learn that someone else has created an account).
    – unor
    May 20, 2015 at 19:07
  • Oh, I guess that's right. Still, if people share emails for whatever reason, the system will have to assume that they have mutual trust.
    – bjb568
    May 20, 2015 at 19:45
3

I would say no, but use sub-accounts if you really need that functionality. I think it can be confusing to the users unless your site supports sub-accounts. Netflix.com has a single authentication account, but there are sub-accounts that support different user preferences profiles.

This puts everything out in the open for users. They'll need to give the username/email and password to the other person(s) if they want to access the account. Then they can manage/use a particular profile. They'll need to know the other person could use/misuse their profile. It may not be so obvious that creating accounts with the same email means the other person could change your password.

An uninformed user could get scammed with a new account confirmation for their email address unless you then require the establishment of username/password at that time.

Improve this answer
0

NO!

Here's a scenario I just encountered:

I used my work email to sign up for my work's website (an online store). This online store allows multiple accounts to have the same email address. I forgot my password for the online store. An email is sent to me to reset the password. I go through reset process. Turns out I just reset the password for a different person who used to work at this company. I was accidentally issued the same email address when I started work there because our name is the same. Also, the online store doesn't check for multiple accounts, it just finds the first account in the database that matches. Now I have access to all of their account info. I can see their order history, name, address, phone, and more.

Most of this could have been prevented by developers who knew how to setup their systems correctly, and if the IT person was more careful with issuing email addresses. But, in my opinion, allowing multiple accounts with the same email address adds complexity and potential pitfalls from human errors. More complexity means there are more ways for things to go wrong.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.