1

I run a website where users authenticate using email and password. Some users would like to have two or three accounts using the same email address. I see the use case in their situation, and am trying to figure out which drawbacks it has.

As for authenticating I don't see them: basically it's a query where both email and password are variables. So that would work.

Password reset in case of loss would not work, as email is the only variable in that case. As admins can manually reset passwords, that would be acceptable.

Is there anything I'm overlooking?

  • Why don't your users use email aliases? Like, a+something@b.c or comments like a(somecomment)@b.c? They are textually different and logically the same. – Tobi Nary Mar 29 '16 at 15:37
  • Can you clarify what you mean by "As admins can manually reset passwords, that would be acceptable"? – WorseDoughnut Mar 29 '16 at 15:42
  • It means the admin can reset the password, therefore an automated, email based password reset is not required. – user1751825 Mar 29 '16 at 16:02
  • @user1751825 I'm referring to OPs use of the word "that", since it seems like he's referring back to the email option. If not, it makes zero sense to me, since admins being able to reset a password doesn't help if they can't validate the user's identity with an email address. – WorseDoughnut Mar 29 '16 at 16:42
  • Admins have a 'reset password' button available in user accounts. It sends a new password to a user. So in case a user with two accounts loses a password, and admin can send a new one. As @user1751825 correctly states. – Lennart Mar 29 '16 at 16:59
2

Password reset, as you've identified. Any type of email notification will not be able to target a specific account.

You could make your site work this way, but it's not a good idea. It's just strange, non-standard functionality. Why require admins to manually reset passwords when users could do it themselves?

What happens if the user forgets which password is for which account? If they request a password reset, how does the admin identify which account to change?

Why does an individual user require multiple accounts? You could investigate the problem they're actually trying to solve, and find a better way to do it.

If it was my project, I would simply tell the client 'no'. Emails must be unique.

It sounds like you're solving one very small (potentially nonexistent) problem by creating lots of new problems.

I could nearly guarantee that eventually your users will ask for an automated password reset utility, or automated account notifications, and you won't be able to provide it.

  • To clear things up, it's a website for a sports club. Some members are family and use a family email account (e.g. father and two kids, kids don't have own email). Alternative would be same email and a different field (e.g. member number) to login. Or figure some way to link accounts an switch identities (like Facebook's 'post as Page' functionality). – Lennart Mar 29 '16 at 17:10
  • @Lennart most kids nowadays have emails - the sheer number of... stuff that needs emails, from Steam to Facebook, makes giving a email to a kid kind of essential. "Family Emails" are a bit absurd, to be honest. I have never, even once, see such a thing as a e-mail for a "whole family". – T. Sar Mar 29 '16 at 17:19
  • Actually it happens more often, also with older people (70+). They are used to sharing everything: mailbox, phone number, bank account, last name etc. – Lennart Mar 30 '16 at 7:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.