Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
If a user registers an account on my Website with Facebook authentication, can I safely skip the "verification email" that is usually sent to users who sign up without Facebook (that is, from a regular "personal details + email + password" registration form)?
Or is there any purpose to sending this verification email (e.g. to confirm the user's email address)?
The "verification email" serves three purposes (at least):
To deter evil people who automatically create thousands of users, for nefarious purposes (e.g. spamming). With the verification of emails, then such people must at least provide working email addresses, which makes them more traceable than when they do not. Also, the least competent of such wannabe attackers may find it difficult to automatically create thousands of working email addresses.
To record on your side an email address which is, more or less, working, in case you need to contact the users again.
To protect password resets. When a user registers with a given email address, then control of that address will serve as the backup authentication for that user. "Control" here means "ability to read emails sent to that address".
If you use Facebook authentication, then you surrender all of this to Facebook, so it makes sense to simply forget all about it. The lack of independent purpose for user's email address confirmation highlights the fact that you really are surrendering your server's access control to Facebook.
(Of course, confirming the user's email address is still required or at least recommended if you intend to spam him send him some sort of newsletter.)
