Assuming an app/website where email confirmation is required before logging in:

If newly registered user tries to sign in, a common flow is to tell them they are have not confirmed their email address yet and then ask if they want to re-send email confirmation, which is a two step process.

Is there are security concerns for just sending another confirmation email (with link) as soon as they try and fail to sign in?

People could end up being spammed but I doubt significantly more than they would in the other flow if someone was trying to be malicious.

  • Could be more of a UI thing: showing the address that they've entered could be a reminder that they used a different address to sign up, or have typoed the address (put gmial instead of gmail, or something like that). In that case, the user doesn't actually need a new email, just to enter the correct details. Depends on the specific flow you're using though. – Matthew Feb 9 '18 at 15:02
  • In this scenario we'd 100% know the user exists, hasn't confirmed the associated email and someone is trying to sign in by putting in that email address. I hadn't considered anyone would sign-up with an invalid email address, in which case it'd be easier for them to re-register correctly and the likelihood they'd make the same typo on register and login is pretty low? – user179876 Feb 9 '18 at 17:40

Frankly, yes, there are some security concerns. The email link grants the recipient access to the account. If the user entered the wrong email, then by automatically sending the activation link again, you offer the unauthorised recipient another chance to take over the account.

If the user lost control over their email account, then the same problem applies.

In general, you want to give users positive control whether access-granting actions are performed.

Also, given that many "schroeders" mistakenly use my email address to sign up for things, I'm glad for non-automatic re-sending of activation emails. I get enough manually triggered email activation links for things I never signed up for ...

  • Ok we can agree email links ALWAYS grants the recipient access to the account, which is kinda the point for forgotten password etc. How would an unauthorised recipient get into an account if you re-send an activation link to the email address? If a user loses control over their email address, they'd have bigger problems and this argues with the whole concept of email validation which was not the scope of the question. – user179876 Feb 9 '18 at 17:31
  • please read my scenario again: if the user types in the wrong email address. I get activation links all the time. If I click them, then my email is associated with the account, which means that I can complete registration or later trigger password resets. – schroeder Feb 9 '18 at 17:39
  • which is already true, if I have your email address I can register you to loads of websites and you would have access to all of those accounts – user179876 Feb 9 '18 at 17:41
  • hold on, you are not seeing the problem: if you are signing up yourself to something legitimate, but mistakenly type in my email address. It's not a spam thing, it's thinking that you are signing yourself up, but I control the email communciations. – schroeder Feb 9 '18 at 17:43
  • For example, I mistakenly clicked an activation link for a service that I had already signed up for, but it was someone else who had created the new account for themselves. That account is now locked in with my email account as the primary. I have full access to everything in his account (he knows this and I forward on emails destined for him). – schroeder Feb 9 '18 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.