The typical signup procedure is of course:
- Alice enters email address and desired password (and possibly other data).
- A verification email is sent to the address Alice provided.
- Alice confirms her email address via a link (with a unique token) in the email.
- Alice now has access to the service.
But in the case of services where users invite others by entering their email addresses, does it make sense to streamline the signup procedure? If the new user arrives at the site via an email link, can't the verification email be skipped?
The flow would instead be:
- Alice (an existing user) invites Bob to the service by entering his email address into the service's invitation function.
- Bob receives the email, which has a link (again with a token) to the signup page.
- The signup page is pre-filled with Bob's email address, so all he has to do is pick a password (the token also gets propagated, so Bob can't craft a request to override the pre-filled email address).
- Bob has access immediately.
I wouldn't be surprised if some services already do this, I just haven't seen any (at least none I can recall).
As far as I can tell, the second flow provides the same amount of verification/confirmation as the first one; in either case, the user follows a link with a unique token that's tied to their address. Or, at any rate, an email account they have access to.
But is it the same? Does the altered flow provide some foothold for attackers?