What are the disadvantages of logging someone in on register?

Question

So presuming a username/password authentication system (not an SSO) if you register a new user, what's the disadvantage of logging them in before verifying their account by email?

Let's presume that by logging them in they won't have access to sensitive content, or the ability to do something like charge a credit card.

Most software I've encountered does. "click register" -> "fill form" -> "send email" -> "activate account" (sometimes allowing concurrent login) -> login.

what I'm trying to figure out is if there's a security hole from basically taking a login form (you gave me a username/password) "click register" -> (account is created and you're logged in); or "click register" -> "fill form" -> "confirm and log in".

Obviously there are user experience advantages/disadvantages, but I've been trying to figure out if there are security implications of doing this. The only only security implication I can think of are SPAM accounts which is where someone is creating users automatically.

I'm just trying to ensure that I'm not making some mistake like not using a nonce in a password reset link (unrelated). Like maybe there's something security related that I don't know that I don't know.

Answer 1

You are introducing a user enumeration flaw into your system.

That is, any attacker can find out if [email protected] is a user on your system by completing the registration process.

This is useful to an attacker for two reasons:

• As per the article linked above

  As an attacker if I can use your login or forgotten password page to narrow my list from 10000 targets to 1000 targets, I will.

• In a phishing campaign, the attacker knows exactly who to send their emails to.

There is also a privacy issue, especially if your site is something sensitive like Ashley Madison.

If the above is a concern to you, you can mitigate by requiring the user to acknowledge the activation email first. See this answer.

If not, then as you are not allowing them to access sensitive content or actions, there is little extra risk. If you were, then you could simply have a flag in the database: EmailConfirmed = 1 or 0, which will let your system know whether they can trust that the email address is genuine.

Also, not verifying users can be an annoyance when an email address is mistyped or purposely entered that of another person, in that the account gets squatted and the real user cannot then register their own account.

The real user of the account can sometimes regain control by completing the password reset process, although their account will then be tainted by whatever the previous occupier has setup. Again, this depends on the system but if there are sensitive settings such as extra recovery email addresses or access keys, or other active sessions, then there should be a way for users to reset their account to a fresh state after any squatting incident.

The other thing that may make reset tricky is if two factor authentication is employed. Any password reset by the real email address owner would be hindered due to lack of the second factor being available. In this case, it would be much easier to validate email address at point of signup instead as things can get complicated otherwise.