5

Being able to confirm your email without waiting for a verification email would be a major improvement to many registration processes. In theory this could be done using a technique based on OAuth, OpenID or similar. Of course, both the site and the email provider would need to support this, in a compatible way.

This leads me to wonder: Have there been any proposals to do this?

Edit OAuth has similar functionality is that email can be auto-filled. However, this does not verify the email. If OAuth provider on foo.com says a user's email is [email protected] then we have to either trust the provider, or reverify. However, the OAuth provider on foo.com can confirm an email address like [email protected].

Improve this question
9
  • I don't know about "proposals", though. When I sign up for OAuth, the service grabs my email automatically. Do you mean verifying emails without signing up for OAuth authentication? So, I'd simply say "OAuth".
    – schroeder ♦
    Commented Jan 29, 2018 at 20:43
  • 4
    many do already: google accounts, passport/live/outlook, etc are providers
    – dandavis
    Commented Jan 29, 2018 at 20:47
  • 1
    @paj28 They would be redirected to the Google consent screen saying "this app wants access to your Google account" along with the details what information the app wants to read (email address). Once they confirm, your app knows the account is legitimate.
    – Arminius
    Commented Jan 29, 2018 at 20:55
  • 3
    i'm not sure i understand the question; google will give you an email that works; how often it's used is unknowable. You can allow only certain providers, whatever you feel is trustworthy.
    – dandavis
    Commented Jan 30, 2018 at 8:08
  • 1
    As other comments above - you need to define "verified". Even clicking a link in email not always enough for verification. One can use services like temp-mail.org/en. Any oAuth provider means you are delegate trust to someone else. It's your decision who you want to trust.
    – Yehuda
    Commented Mar 25, 2018 at 13:10

1 Answer 1

Reset to default
2

BrowserID is a mechanism that allows websites to confirm the e-mail address of a user without each website needing to send an e-mail. Mozilla Persona added the ability to do so in a less centralized way that enhances privacy somewhat however it did still require central servers that Mozilla no longer provides.

Alternatively an X509 client-cert that includes the e-mail address would work although it raises the bar somewhat as regards ease of use.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .