i allow members to sign up/ login in using external logins (social networks and such), the problem is that, if i didn't ask them to confirm their emails then how would i validate their ownership to this email (assuming the social account wasn't theirs) which then will mark my mail as spam

second, for security purposes, i force users that wish to change their email before confirmation or resend the confirmation to same email to enter their password, which wouldn't exist in the case of external login unless i ask for it (which is forcing the user to do extra steps)

so it's being completely secure with extra way to login other than the social network account vs convenience and ease of the signing up process, so which should i use, or should i let the user decide, but would it matter from a security perspective?

1 Answer 1


Principle: "Excessive" security measures make users search for ways to bypass security, thus defeating the purpose.

From my experience of implementing similar systems - and the logic we used to design them:

  1. The idea of federated authentication is to "depend" on the identity provider to do the ground work for certain properties of the identity - so that you don't have to. If you are using Google/FB/LinkedIn or similar social media logins, this is a basic premise. The key here is that you make sure that the identity provider's processes are indeed verifying the property (attribute) they are asserting. So in general (i.e., unless your threat model indicates an exception) - you don't need to further verify an email address (which is among the most basic identity attributes).

** You mentioned "assuming the social account wasn't theirs": For most applications, I'd say this isn't a threat scenario that the app designer needs to cover for. All in all, asking email to be verified again after a federated auth appears to a bit of excessive precaution hurting the security cause more than helping it.

  1. There are several recommended password reset flows

Though it's not explicitly stated in either of the above, the need for a password reset through a registered email doesn't increase the need for additional verification at step 1.

Summary: Unless your app has a specific threat, email from a reputed identity provider's authentication flow should be sufficient without further verification.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .