2

Could we consider it as a security flaw to not ask an email verification on account creation?

Let's say there is a service that ask you to enter an email address as a username and a password in order to create an account. Then, as soon as you press the "create account" button, your new account is ready and you're never asked to verify your email address.

The first thing that comes to mind is that you won't be able to get back this account if you don't own the email address, but is it also possible to exploit the fact that there is no email verification to deny possible users to the service?

For example, if I own a competitor company, I could create account using the email of my clients on that other company website and I would effectively block those clients from creating an account using their favorite email address for that other company.

It's just annoying to the user to try to create an account and realize that your own email address is already taken while you have clearly not created an account, but, on the web, anything that annoy your users will make you lose customers.

Note

I'm asking that question because I believe a previous question got misunderstood and I'm assuming in the other question that this is a problem. So please, help me understand whether or not this is an issue.

Improve this question
3
  • 1
    whether or not that it's a security flaw will depend on the impact of loss of the availablity of the service
    – schroeder ♦
    Feb 10, 2016 at 18:47
  • 1
    It is also annoying from the standpoint of the email address owner, if someone registers with your email and that service keeps sending emails.
    – chrki
    Feb 10, 2016 at 18:52
  • If your site sends out emails, the real owner of the email adress might not be happy with all the spam you are suddenly sending.
    – Anders
    Feb 10, 2016 at 22:28

1 Answer 1

Reset to default
4

The answer to your question likely depends on a couple of factors.

  • Can the e-mail address used for registration be used for password reset. It would be a mistake from a security and usuability perspective to do this where the e-mail address was not validated during registration as a typo during registration could effectively lock you out of your account, if you forgot the password (absent any other password reset mechanisms). Also if you register using someone elses e-mail address (for whatever reason) they can effectively steal the account from you in this case as they can just trigger a reset and take control.

  • Is there some real world consequence to someone using an e-mail address that they do not own. For example if a user fraudulently registers as [email protected] would that achieve some security relatd goal where they could mis-represent themselves as being Bill Gates?

So the consequences of this very much depend on the nature of the site in question and are hard to be precise about in the abstract.

Improve this answer
1
  • Well, you would stop Bill Gates from using his [email protected] address to create an account on this site too (assuming he can't use it to reset his password)
    – Gudradain
    Feb 10, 2016 at 19:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .