Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm working on a site which allows users to sign up for a service. They choose a username/password, enter their personal details, etc and proceed into the site, their details being stored for future visits.

Currently, we don't ask for confirmation of the user's email address like most websites do.

The main function of the site is to process payment information for the service being offered but the client will likely want to expand the functionality of the site in the near future.

So my question is, should I be implementing an email confirmation system for new users and what are the risks to the site if I don't?

share|improve this question
3  
In addition to the answers provided, it's also handy as it stops users impersonating others to a degree (prevents them using someone else's email address) –  fin1te Aug 15 '12 at 17:57
2  
This has more to do with trying to prove an actual human signed up instead of web crawler. While it can be trivial to parse an email for links, bobince makes it sounds a great deal easier then it actually is, depending how complicate the formatting within the actual email is. –  Ramhound Aug 16 '12 at 11:37

5 Answers 5

up vote 10 down vote accepted

You will want to be sure that a user's e-mail address is correct if you intend to send mail to it that is either:

  • security-sensitive (eg forgotten password reset token), or
  • recurring/high-quantity, to avoid harassing some other person whose address has been entered.

This is typically more about weeding out incorrect addresses that have been entered by mistake than some malicious attack.

If you never intend to send mail to the address, you're only really using it as a fixed-format username and there is no particular need to validate it. But I would imagine that's an option you probably want to keep open.

E-mail validation is not about rate-limiting sign-ups. It's totally ineffective at this for anything but low-motivation/untargeted attacks, because there is no scarcity factor on e-mail addresses. It's trivial for an attacker to register some domains, use unlimited random e-mail addresses on them, and validate using an automated tool reading their inboxes.

share|improve this answer

email confirmation will help you determine that the person who says their email is foo@bar.com actually has control of this email.

The benefits of forcing them to confirming their email are:

  • You verify that the email address is exists and mail can be sent to it
  • You verify that they actually have access to the inbox

should I be implementing an email confirmation system for new users and what are the risks to the site if I don't?

If you intend on sending mail for any reason, it's really a good idea to confirm the email address.

If you don't confirm the users email then you risk:

  • sending email to somebody that doesn't want it
  • the email bouncing back because it doesn't exist
  • sending sensitive information to the wrong address (this could be intentional by the user, or they could have mis-typed their email)
share|improve this answer

If you plan on sending email to that address then you need to verify to avoid being identified as a spammer.

If you ask the user to agree to a contract and you can't verify identity based on some other information like a CC#, then you need to verify. If not, then if you ever need to go to court for breach of contract, you have no evidence that the person you're suing was the one who used the service.

If you are legally required to limit access to your site (for example, to people of a certain age), then not taking common steps like verifying email could be used against you as evidence that you're not serious about filtering your clientele, even if you have other methods to filter.

share|improve this answer

You should implement e-mail confirmation for new users, if for nothing else than 'security theater,' users expect that once they sign up for a service using an e-mail as an identifier they expect verification.

Taking your question in a vacuum without making further assumptions, the risk to your users or really potential users is relatively low. The risk to your infrastructure could be significant, once your man-hours to fix and vet user ids has surpassed the amount of time it would have taken to standup a system to verify e-mail addresses.

share|improve this answer

Because chances are you will attract spammers that create thousands of account an hour. With registering an email address you reduce this number significantly.

share|improve this answer
    
the rate limiting aspect of this is a large part of why you might consider it. –  Bill Aug 15 '12 at 16:31
3  
How does this effectively rate limit? If someone has a domain then they have a virtually unlimited number of domains, and writing something that scans mail and GETs URLs in them is trivial. –  Mike Samuel Aug 16 '12 at 6:32
2  
@MikeSamuel, it does work in practice because most Spammer don't care at the moment. –  Hendrik Brummermann Aug 16 '12 at 9:14
    
@HendrikBrummermann, It doesn't make sense to say that something works when it's likely to stop working as soon as it matters. –  Mike Samuel Aug 16 '12 at 15:32
1  
A domain is a lot more simple to block and delete than when an open registry system is used –  Lucas Kauffman Aug 16 '12 at 16:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.