Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
There's lots of information on using one email for multiple accounts, but how about the other way around? I'm building a service and considering allowing users to log in with any of their registered emails, using the same password for all of them. Instead of a "my account is my email" mindset, I'm going for a "my account has emails that I can use to access my account" mindset.
Aside from increasing the discoverable routes of entry for an attacker, are there any security downsides to this?
This is a fairly common practice for a some popular sites. Disclaimer, I've never done this for my applications, but from what I can tell, not really security-wise, other than what you mentioned. It's really the implementation that will take some thought as there are fewer packages out there that are going to support such behavior out of the box. Think about things like limiting the number of email addresses a person can use, communication procedures (ex. do password resets go to just the primary email, or would you allow any attached email), database schema, etc.
Here's an example of a couple of sites that do allow users to have and log in with multiple emails: github.com, facebook.com and internet.bs.
There is nothing bad in allowing more than one usename per account: this pattern exists from the beginning or Unix systems in the 70's. But the common pattern is to then use one password per user name instead of one password per account. First it integrates more smoothly with authentication softwares, and it allows banking applications to give one user-password pair to every user of a join account.
The downside is obvious, the weak link is the E-mail. If any of the E-mail accounts is compromised (possibly found in a public pwnlist), then an intruder can log in to your website.
There is also a real possibility that some E-mail accounts will become obsolete over time. Either because they have been unused for too long and the handle has been returned to the available pool (free E-mail), or the domain name has expired, dropped and become available for registration again. There is an opportunity for account takeover (reset password etc). I don't expect users to maintain the list of registered E-mail accounts up to date on your site...
If a user can log in with multiple E-mails that can be a source of confusion too: they may not remember which E-mail accounts they have used if you gave them the opportunity to list more than one. There always has got to be a trade-off between convenience and security. I am not seeing what kind of convenience you are trying to add here.
