0

Steam just asked me "Is this still your email address? [email_address_here]"

This is an on-PC app that I trust, so I'm 100% confident of its legitimacy.

I would like to know about its usefulness. I get these kinds of requests periodically from dozens of apps or online services, and it's kind of a time-sink.

  • Easy enough to click "Yup, still my email address", 1 second and done. Oh wait...
  • They want to send a confirmation email to that email address.
  • I have to fire up my email app, log in, find the email, copy the URL,
  • Fire up the other browser I use for this and paste the URL,
  • and then they want me to log in. Ugh. [Steam didn't, but many do.]

What is all this rigmarole really doing? Does it really help my security in any way? How does it help me for them to confirm an email that I know is good? I don't mind being a partner in security, but this seems utterly petty. Can you explain what good it actually does?

I'm only looking for InfoSec value. I couldn't care less about marketing value, engagement value or UX considerations (it's a given those aren't good).

1
  • You may find the answers in this thread helpful.
    – user171922
    Mar 16, 2018 at 6:55

3 Answers 3

2

Besides the obvious UX values, this practice (if done correctly, like Steam) actually helps to mitigate stolen accounts.

This is what Steam does with all e-mails (both on update and periodically)

  • Ask user for email / Ask user is email is still valid for him/her.
  • Validate email selected with a one time token that is transmitted to given email address.
  • User uses 'link' / 'token' to validate email retrieval (this does NOT require authentication, nor does it AUTHENTICATE the user)
  • Steam notifies user that said email is now considered valid for the user and will be used for security announcements regarding its account (login tokens for 2FA, suspicious activity etc.)

Now, since a lot of people use their provider's e-mail account, there are many cases where this changes over time. These steps help to notify the user of what email is being used, validates that its mail server is still up to par and working for said user (this is done through strict mail delivery settings on the MTA of Steam). And that the user can actually receive notices when something security related happens to the user (a breach or loss of password or something).

11
  • 2
    I'm confused: how is the 2nd confirmation some time later help to secure against stolen accounts?
    – schroeder
    Mar 16, 2018 at 14:43
  • its an additional barrier to hop through when trying to obtain an account. the retransmission helps to both make the user aware of how the system sees him (what email account) and to validate that its still a working channel for security notice information
    – LvB
    Mar 16, 2018 at 14:44
  • 1
    I think that it is a stretch to say that the ability to communicate to users about potential security issues is in itself a security function. As the OP states: if I steal the account, I'll change the email associated with it.
    – schroeder
    Mar 16, 2018 at 14:44
  • still confused: how is it a hoop to obtaining an account?
    – schroeder
    Mar 16, 2018 at 14:45
  • Assuming you "steal" the account through a username/password. When you want to change the e-mail associated with it (and we know it was recently still valid for said user) You need to validate the change of credentials through both old and new email account. A feature you can not use if you do not keep the current email uptodate.
    – LvB
    Mar 16, 2018 at 14:48
2

It is very important to make sure that users email addresses are accurate. Almost always, the owner of the email address is the owner of every single account that ties back to it.

For this reason, it is obvious that it is in both the user and the vendor's best interest to periodically check that the user and the vendor agree on which email address the account is tied to. It is reasonable to prompt the user with "Hey, are you still using @.com?"

The rub comes when the vendor asks the user to go through the verification process again. As you've mentioned, it is tedious and time consuming. The initial verification process is important - you don't want to let people sign up accounts they don't own for a service. At best that is a nuisance or a mistake. At worst, it can be targeted harassment or an attempt to compromise future legitimate accounts.

Once you've verified the email account, the trade off between worth and tedium shifts - the main problem that re-verification seeks to solve is if a user loses access to their email and doesn't know it. This isn't unreasonable if a user is using a set-and-forget email for signing up for services, but I don't know that that is common enough to be worth annoying all your users over.

2
  • It's important, yes, but is it important for security? That's the part that I'm not seeing.
    – schroeder
    Mar 16, 2018 at 14:57
  • Yes, because if a user loses access to their account through whatever means, they need to agree with the vendor on which email address is appropriate to treat as the account owner's. Typically this will be the initial setup email, but my steam account is 14 years old, it's not unreasonable to periodically remind me to update my contact info. This is all relevant to security because recovery and remediation is a part of security, and failing to follow this process can slow down recovery, or even worse, prevent it or give it to an attacker, if a user no longer has access to their original email. Mar 16, 2018 at 15:25
1

This is not a security measure, but a "permission to email" issue and a marketing housekeeping issue.

There is growing desire for services to ask users to re-opt-in to email communications on a regular basis (yearly). This "confirmation" question acts as a de facto opt-in.

In addition, customer management systems are better if the data is current, and CM systems have a lot of stale info. A lot of research has recently been done on this stale info, and the results mean that services want to know if the data they have is current.

So, no, this is not for security.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .