I am designing a website with a login/signup feature. I was testing some websites to see how they handle this correctly.

I confronted Instagram and see it lets me login without confirming my email account. So, I can register and login with my friend's email and he would have to create a new email account for himself. Am I missing something here?

  • 2
    Surprisingly many sites allow registration without email confirmation. Someone has apparently submitted his/her DNA to MyHeritage.com using one of my honeypot addresses. Didn't care to log in as I don't have any high expectations of the quality of the DNA in question. And because it might have been illegal, too. – Esa Jokinen Apr 7 '19 at 15:07
  • If the site allows password resets with nothing more than an email, then your friend could lock you out of the account you created. With a new password, they could take advantage of a delete account feature and register themselves. Or they could delete your content without deleting the account. Some websites include a "This isn't me" link that can be used to cancel signups. And there must be some websites that let you sign up for multiple accounts with one address that rarely email you. (Not that making the email important and then not verifying it is a good idea.) – Future Security Apr 8 '19 at 22:11
  • I think the best approach is what twitter implemented. – Vahid Najafi Apr 9 '19 at 7:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.