1

I've moved onto a project where they are implementing a system whereby a user's email address can be used multiple times by different people - i.e. users can sign up as many times as they want with an email address as there's no unique constraint. The theory is that they won't have actual access to the email account so it's not a problem.

I can't think of any issues with this but something about this approach doesn't feel right. The email address is not used as a unique identifier although people log in with it but what potential issues, if any, could rise with this approach?

Edit - Resetting a password doesn't send an email, their theory is that if the user has stolen the phone, they likely have access to the email address on the phone. Instead, they need to enter security questions/answer else they need to create a new account (which is why they want to allow duplicate email addresses). My worry is that this somehow creates a new attack vector for hackers but can't figure out how and I may just be wrong.

Thanks

Improve this question
5
  • How users are identified then? If one setups two different accounts with the same email and password, how would he choose which account he would like to use? – WhiteWinterWolf Sep 24 '15 at 10:07
  • @WhiteWinterWolf - I raised this question when I heard about it. The idea is that if a user forgets their password, we don't send anything to their email because this is a mobile app. If you've lost your phone, there's a chance the thief has access to the email account that's also signed in. Therefore, if you forget your security questions and password, you sign up again but you can use the same email address. It's unlikely the password would be the same as the user has forgotten it and so we iterate through the password hashes for the one that matches and log into that – Secoority Sep 24 '15 at 10:18
  • 1
    Ok, so if I understand correctly you have the couple "userid (email) + password" which is unique, however the same userid or the same password might be reused and be associated to different accounts, am I right? When a user creates a new account by reusing an already existing email address, does he have access to any data from the previous account or is it a plain new account? – WhiteWinterWolf Sep 24 '15 at 10:24
  • You're right, if two people happened to use the same userid and password, the first one in the database would be selected. From a hacker point of view, this is unlikely as they wouldn't know the user's password but from a user point of view, they lose access to everything that was with the other account; it's a plain new account – Secoority Sep 24 '15 at 10:30
  • 3
    I'm wondering why u are using the email address as your identification if it is not unique. Why not let users log in to their account using something else like a classic username (which are unique)? You can then still allow email-addresses to be not unique but have the benefit of having a more traditional (and thus time proven) account system. When creating the account you should however check the email-address is theirs but if you don't want to use it for password recovery I cannot see a problem with this. A user would have to use a different username for a new account though. – Selenog Sep 24 '15 at 11:56
4

I'm assuming that in the case of duplicate accounts, different passwords are used as the means of distinguishing between these accounts?

i.e. if there are two bob@example.coms, one with password foo and one with bar then the password will be checked to find out which account to log the user into.

Problems with this approach would be:

  • If one user with an email address sets their password to the same as another account with that email address, then there is no way to warn the user without revealing that the password matches another account.
  • Account lockout policies cannot identify the account to lockout because the password has not been entered incorrectly.
  • Using a secure password storage algorithm such as bcrypt becomes impossible because there is no unique index on which to find the salt in order to determine if you have a password match. Each matching account would have to be tested, leading to long delays on login as each password hash is attempted.
  • Any password guessing attack against a user account has multiple attempts to succeed from each request, aiding an attacker.
Improve this answer
1
  • Thanks, these are all good points I will raise. Ultimately it's not my decision but I'm not comfortable with the approach when there are other valid options available. – Secoority Sep 24 '15 at 12:39
-1

If the user uses forgot password then the new password will be sent to the email address with which he has logged in.

This makes the user whose email address is used accessing the password and can use it to login and perform actions.

Improve this answer
5
  • Apologies, I should've clarified that they don't want to send reset links via email. The user has to enter security question/answers to reset but if they've also forgotten those, they have to sign up again (but can reuse the same email address) – Secoority Sep 24 '15 at 10:19
  • If two users sign up with same email address then how the server decides which user logs in as both the user will have the same username. – Irfan Sep 24 '15 at 10:21
  • They plan to iterate the hashed passwords to see which matches – Secoority Sep 24 '15 at 10:29
  • If an account is created with the email address and another account is being created with the same email address and the second user enters the same password as the first user, does the server gives an error? – Irfan Sep 24 '15 at 10:34
  • No error at this stage but there's no reason that couldn't be implemented as the hashes would be the same. – Secoority Sep 24 '15 at 10:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.