Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am developing a web application (using PHP) and I am wondering what the best way is to notify users that someone updated their account information? The information that can be updated includes:

  • First name
  • Last name
  • E-mail address
  • Password

To be more elaborate, should the old or new email be used to send the account update notification? What information that was changed should be sent in the e-mail (ie: name, e-mail, password)? Is it necessary to have a activation e-mail sent if the e-mail address is changed? I should also note that the e-mail address is being used as the username.

share|improve this question
    
Why you insist on email as the very right means of alerting user? I mean If I'm the one who hacked your user account I will never change your user-name or password or anything of that sort. Its not enough to just detect account changes but also alert on suspicious account usage (like access via different country ip) –  Saladin Apr 27 '13 at 18:55

1 Answer 1

up vote 3 down vote accepted

You should always assume that registration information is what your real user wants, any later change and the user should be notified, especially when it comes to critical information such as username and password.

  • When the email address is changed, an confirmation email should be sent to the new address containing a link to activate the new email address. A notification email should be sent to the old address as well (containing a link to revoke/report this change).

  • When the password is changed, a notification email should be sent to the current email address containing a link to report/revoke the change.

  • First name and last name are a special case. They're non-critical information, but they're unlikely to change very often. So I'd say go with what best suits your application.

  • Other information such as age, about me, likes, sports, hobbies, etc... are clearly non-critical information. Personally, I'd like to have the option to be notified about them, so it's nice to have an opt-in checkbox for that.

share|improve this answer
    
Wouldn't it be better to send a confirmation email to the old address? –  Terry Chia Apr 27 '13 at 7:12
    
What to do in case of old e-mail account being compromised? –  Deer Hunter Apr 27 '13 at 7:13
    
@TerryChia Well in that case two confirmation emails should be sent, I don't think asking the user to click two links is a great user experience. It's enough to allow the user to revoke this change from his old address (presumably his genuine address) –  Adnan Apr 27 '13 at 7:15
1  
@DeerHunter Nothing. This how this works, your account is linked to that email address. The user's mobile can be compromised and the activation codes could be used, the user's machine could be compromised with a keylogger. I don't see how that could be the problem of your application. Of course, normal recovery steps could be taken (the same ones used by Facebook for example). –  Adnan Apr 27 '13 at 7:19
    
@DeerHunter Also, I don't see how this relates to the question. If the attacker has control over the account, the old email, and the new email (chosen by the attacker) then it's a whole different story. –  Adnan Apr 27 '13 at 7:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.