Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Many websites and/or web apps require you to validate the e-mail address after registration.
Why don't we first validate the email address and then continue with the registration? Is there something wrong with a person first providing their email address, getting a validation email, going to the URL send in the email and then providing password and other details?
Why don't we first validate the email address and then continue with the registration?
From the security perspective this should be similar. From a usability standpoint it might be worse, or at least unexpected. Moreover, the expectation today is to provide easy and fast user registration because every additional friction might mean lost customers. So often the freshly registered account can be used for a while already without validating the email address immediately.
If user forgets password or if accounts is locked, some way is needed for user to reset the password. It can be done by asking some questions about something that is expected not to be known to any random person, or by sending an SMS, or by sending a temporary password or some link to user per email. If user has not confirmed the access to the provided email, resetting the password via email may be impossible.
Asking questions (like the title of your favorite movie) is usually not very reliable, because such information can be known to many persons. It can only be reliable, if the user provides as an answer some relatively long random string, generated by a good random generator. Since the most users are expected to provide the real answers, this can be insecure.
Emails are considered as more secure, because it is expected that only the user has access to the email box.
In case the email is validated after registration many web sites don't usually enable any services until the email is validated. Thus user is forced to validate the email.
From the security point of view validating the email in advance or afterwards has no difference.
Validation at different phase can have usability differences. E.g. some users may prefer providing email and password at the beginning and validate the email later on, because they may find association between email and password more natural, because it happens at the same time. Whereas providing first the email, then validating, then providing the password may break such association. But as many usability aspects this is a matter of taste.
There are also other aspects not related to security. Validating email in advance makes sure that the user is the owner of the email. Whereas validating it after registration may enable the kind of defamation. E.g. you may register your neighbor at some web site associated with drugs or alcohol and never confirm it later, because you don't own this email. But if the web site keeps such unconfirmed accounts, and if the list of the users becomes widely known, this might have some reputation effect for the person whose email was used for registration. But again, this is not a security aspect.
There is nothing wrong with requiring validation of the email address before continuing registration. Many websites actually do this.
Websites that don't do this are either older and have not updated their security standards, or don't care about having spam bot registrations on their website that haven't yet validated the email address and would rather make registration easier.
Of course, if they require validation of the email before the registration is activated, that doesn't reduce the security of their website, it just means there will be a lot of user accounts that will never be validated that will have to be cleaned out or expired eventually.
