Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I writing a security layer for my app and I would like your input on updating users' email addresses (also used for the login).

I'm interested to hear from anyone who has written an application with similar requirements. How would you go about it? Here are some ways I thought of, but I suspect I'm missing something:

Approach one

  1. Update the address and send a confirmation email to the new address
  2. If address is not confirmed with 48 hours, suspend it
    • It's easy.
    • If new address is wrong, the user gets locked out of account.
    • Someone can hijack the account by changing the user's address.

Approach two

  1. Update the address and store the old value temporarily
  2. Send a notification email to the old address with an option to revoke the change
  3. Send a confirmation email to the new address
  4. I restore the old address if the user revokes the change (through the notification email)
  5. If the change is not revoked, but the new address is not confirmed within 48 hours, I suspend the account.

    • Secure
    • A lot more work

Approach three

  1. Do not update the address but store the new value temporarily
  2. Send a confirmation email to the old address asking to confirm the change.
  3. If the change is confirmed, carry out the update and send a confirmation email to the new address.
  4. If new address is not confirmed with 48 hours, suspend the account.

    • Secure
    • A lot more work

It's best to be as secure as possible, but I don't want to put the user off by giving them 1001 things to do just to change an email address.

They might also have secondary email addresses, not used for login, but for other purposes, and I'm not sure how to handle updates to those addresses. Ideas are welcomed.

share|improve this question

2 Answers 2

up vote 7 down vote accepted

If you trust your login mechanism, and users can only change their emails while logged in, then simply:

  1. Update the email address.
  2. Notify the user on the website.
  3. Send an email notification to the old email address about a change, including a link to report any problems.

Otherwise, use your Approach three, but without point 4. Also, in this case, send notification about the update to both email addresses.

share|improve this answer
2  
I agree with this, except an email notification to the old email address should not be optional. The purpose of notifying the old email address is so that, if the user's login+password get compromised, they at least receive notification that the email address has been changed. The notification to the old email address should also list the new email address that the account has been changed to, and include a link to report a problem (or cancel the change) if the change was unwanted. –  D.W. Nov 21 '11 at 2:57
    
@D.W. Agreed. I updated the answer with your suggestion. –  Darthenius Nov 21 '11 at 9:11
    
@D.W. and Darthenius, how do you handle the UI side? If the user is viewing the account before the confirmation took place, do you show him the existing email address or the one pending update? Do you include a notice to say "x is pending update to y," etc... seems a bit quirky visualizing the whole process... –  Mohamad Nov 21 '11 at 12:46
    
@Mohamad I think it's fine to just show the currently active email address. –  Darthenius Nov 21 '11 at 14:13

My conclusion is essentially the same as Darthenius's.

I don't understand why you always lock the account if they don't follow up. That doesn't seem secure: there's a big risk of lockout.

Any approach that requires access to the old address fails to handle the case when the user is changing his address precisely because he no longer has access to the old address. This is a common case: first you lose access to an email address, and then you realize there are a dozen places that still use it.

Ideally, both email addresses should remain valid until the change of address is confirmed. It is common to lose access to an address, but less common that this address is reattributed immediately (usually, it's an institutional address that you lose because you lose your job, studentship, …).

If you can only have a single address, then treat the old address as valid until the new address has been confirmed. Do nothing if the new address is not confirmed. This is your approach three, only without the lockout. It's not much work: all you need is one pending address change record, which the confirmation code from the confirmation email triggers.

Primary or secondary email address doesn't really enter into the picture.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.