Is it bad security to pre-filled all the signup fields for my users?

Question

I have a list of people with all their personal information (name, first name, date of birth, email, etc.). I created an account for each of these people in my database. I'm using Firebase.

Since I already have all my users info, I don't want them to type it again when signing up to my website.

So I created a system using a custom token for authentication. I send them as a parameter of an URL to every of my users.

• When the user clicks on the link for the first time: he gets redirected to the signup page with all the fields pre-filled (name, date of birth, email, etc) except for the password. He types the password he wants and gets signed up.
• When the user clicks on the link every other time: he gets redirected to the login page. A simple email + password interface with the email field already pre-filled. He types his password and gets logged in.

This is working great BUT I'm wondering : is this bad practice to do so ? Is this insecure to let anyone who gets the email to create an account in the name of my user ? Should I assume that someone, other than my user, may have total access of my user email account ? Should I be prepared for this eventuality ?

Answer 1

GDPR is a bit vague about what is good enough, but if you are showing people's PPI using single factor authentication sent to email accounts which may belong to multiple people, you are getting into uncomfortably gray territory. Also, depending on the nature of the protected information your system uses, there may be further obligations for 2-factor authentication or other compliance standards to consider.

To better protect your users PPI, I would recommend not auto-filling a form with personal information, but just not requiring them to fill everything out. Since you already have some of their information, you can use that to add a verification question to the form that can not be answered based on the email, So, your email could direct them to a form that just asks for something like their account number or birthday or something like that along with their new Username and Password. You don't need all of their info, just enough to establish a second factor of authentication, and then once they are in, they should be able to adjust their account settings if there is any personal information that needs to change.