2

There's lots of information on using one email for multiple accounts, but how about the other way around? I'm building a service and considering allowing users to log in with any of their registered emails, using the same password for all of them. Instead of a "my account is my email" mindset, I'm going for a "my account has emails that I can use to access my account" mindset.

Aside from increasing the discoverable routes of entry for an attacker, are there any security downsides to this?

3 Answers 3

0

This is a fairly common practice for a some popular sites. Disclaimer, I've never done this for my applications, but from what I can tell, not really security-wise, other than what you mentioned. It's really the implementation that will take some thought as there are fewer packages out there that are going to support such behavior out of the box. Think about things like limiting the number of email addresses a person can use, communication procedures (ex. do password resets go to just the primary email, or would you allow any attached email), database schema, etc.

Here's an example of a couple of sites that do allow users to have and log in with multiple emails: github.com, facebook.com and internet.bs.

1
  • If it's good enough for those sites, I guess it's good enough for me. We're writing our own system so no issue with packages not working, and password resets would likely go to wherever the user puts as their email. Feb 24, 2020 at 3:18
0

There is nothing bad in allowing more than one usename per account: this pattern exists from the beginning or Unix systems in the 70's. But the common pattern is to then use one password per user name instead of one password per account. First it integrates more smoothly with authentication softwares, and it allows banking applications to give one user-password pair to every user of a join account.

2
  • Is the banking part just an example? Because I'm not involving any banking in my application. Feb 25, 2020 at 1:57
  • 1
    It is just a real world example of a web application allowing more than one user name (mail) per account... Feb 25, 2020 at 6:51
0

The downside is obvious, the weak link is the E-mail. If any of the E-mail accounts is compromised (possibly found in a public pwnlist), then an intruder can log in to your website.

There is also a real possibility that some E-mail accounts will become obsolete over time. Either because they have been unused for too long and the handle has been returned to the available pool (free E-mail), or the domain name has expired, dropped and become available for registration again. There is an opportunity for account takeover (reset password etc). I don't expect users to maintain the list of registered E-mail accounts up to date on your site...

If a user can log in with multiple E-mails that can be a source of confusion too: they may not remember which E-mail accounts they have used if you gave them the opportunity to list more than one. There always has got to be a trade-off between convenience and security. I am not seeing what kind of convenience you are trying to add here.

1
  • A "mail address" can be used as a login name for an account even if the mail box no longer exists. And I have accounts on different website sharing the same email addresse, each with its own password. An email address is by definition a public data, else only its owner could send messaged to themselves... Feb 24, 2020 at 13:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .