5

Being able to confirm your email without waiting for a verification email would be a major improvement to many registration processes. In theory this could be done using a technique based on OAuth, OpenID or similar. Of course, both the site and the email provider would need to support this, in a compatible way.

This leads me to wonder: Have there been any proposals to do this?

Edit OAuth has similar functionality is that email can be auto-filled. However, this does not verify the email. If OAuth provider on foo.com says a user's email is user@bar.com then we have to either trust the provider, or reverify. However, the OAuth provider on foo.com can confirm an email address like user@foo.com.

  • 3
    This is not UX. This is the right place to ask this. – schroeder Jan 29 '18 at 20:42
  • 4
    many do already: google accounts, passport/live/outlook, etc are providers – dandavis Jan 29 '18 at 20:47
  • 1
    @paj28 They would be redirected to the Google consent screen saying "this app wants access to your Google account" along with the details what information the app wants to read (email address). Once they confirm, your app knows the account is legitimate. – Arminius Jan 29 '18 at 20:55
  • 3
    i'm not sure i understand the question; google will give you an email that works; how often it's used is unknowable. You can allow only certain providers, whatever you feel is trustworthy. – dandavis Jan 30 '18 at 8:08
  • 1
    As other comments above - you need to define "verified". Even clicking a link in email not always enough for verification. One can use services like temp-mail.org/en. Any oAuth provider means you are delegate trust to someone else. It's your decision who you want to trust. – Yehuda Mar 25 '18 at 13:10
2

BrowserID is a mechanism that allows websites to confirm the e-mail address of a user without each website needing to send an e-mail. Mozilla Persona added the ability to do so in a less centralized way that enhances privacy somewhat however it did still require central servers that Mozilla no longer provides.

Alternatively an X509 client-cert that includes the e-mail address would work although it raises the bar somewhat as regards ease of use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.