Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

I need to allow users access to an application after verifying that they belong to the claimed institute through university email id. So that if a person claims that he belongs to Stanford University, he has verify that he posesses email account that ends with ...@stanford.edu. Sometimes department may have they own subdomain like ids may end with ...@cs.stanford.edu.The people that need to be allowed access to application could be faculty & students as well.

Is this a solid way of determining whether the person belongs to the claiming institute ? Any issues with this & how could this be made more better ?

share|improve this question

migrated from academia.stackexchange.com May 29 '12 at 8:27

3 Answers

up vote 1 down vote

The most commonly used technique is to send an email to that address, containing a one time link they need to follow to confirm they received the email.

There are potential flaws with this (such as someone who can gain access to the email without actually being a member of that institution) but as a simple solution which doesn't require you to interface with the databases of the institutions involved or carry out manual confirmation it can be effective.

What are the risks involved if the wrong people gain access? Is it a major issue, or are you just trying to prevent opportunist individuals who may wish to freeload on your service?

share|improve this answer
I think the question might be partially asking how to check whether an email address is from *@stanford.edu when it could be *@cs.stanford.edu or *@xyz.stanford.edu and still be valid, i.e. you need simply to specify valid addresses as being *@stanford.edu and *@*.stanford.edu, surely? – Savara May 29 '12 at 9:37
If previous contact with the individual is available (i.e. they logon to the website to create an account) you can collect a challenge question/answer to be entered when the email validation link is clicked. However you would need to also consider what occurs with a password reset etc.. If the user is not asked for a challenge when resetting a password it might be a moot point to ask for one on email validation. – Bernie White May 29 '12 at 9:50
up vote 3 down vote

I know several universities/collages that leave email addresses to their alumnus. So only thing that you can check is that the person WAS associated with the university at some point of time.

A

share|improve this answer
This is correct. I've been out of uni for many years now, yet I still have access to my uni email account, and still get monthly emails from the student union department! – Polynomial May 29 '12 at 14:46
Yes i m fine with this. :) – user01 May 31 '12 at 4:01
up vote 0 down vote

Microsoft is working on a technology called UProve that allows people to keep privacy controls while letting certain websites know if they are a student, citizen, married, etc. Each component of the information is secured and in the users control (though they can't tamper it).

In this case they could share the studentID with your website.

http://www.microsoft.com/mscorp/twc/endtoendtrust/vision/uprove.aspx

Too bad this is still in the R&D phase.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.