1

A web shop allows orders from guests. When checking out, the guest has to provide an email address (in addition to shipping address and payment data). When this email address is already in use by a registered shop user, the guest order shall be associated with this user account.

Would it be secure to associate the guest order with the user account automatically, without requiring the guest to login beforehand (to prove that the guest is the one claiming to be)?

What could happen (in the worst case) when the guest has malicious intent?

Scenario: Alice is registered with her mail address. Bob knows this and orders something [providing shipping address and payment data of him|Alice|someone else] as a guest, entering Alice’s mail address.

Social engineering would be the only attack vector that occurs to me here. Which might be especially painful when the guest selected payment in advance (resp. per invoice) and the user is somehow tricked into paying for an order that gets shipped to the guest.

2

No, no no. This is not a good idea under any circumstances. Guest orders are guest orders, period. They require contact information, shipping information, and payment information...Always.

Logging in provides the convenience of having none/some/all of this information pre-populated, and it's a requirement for having orders automatically associated to an account. Without a login process, you'd be essentially authenticating a user based on email address alone, which could never be sufficient.

The only reasonable compromise I see if that if a guest user creates an order using the email address of a known user, add it to a queue and the next time that user logs into the site you might then ask them if it was their order and if perhaps they'd like to add it to their account for tracking/record keeping purposes, and give them the option to either confirm or deny that it was theirs.

Associating it to their account automatically would simply be a bad idea, not only for the reasons that you and GoD have already stated, but from a user experience perspective in any case that isn't on the happy (designed use) path.

0

I'm assuming that you wouldn't actually allow someone to order something without requiring email verification first. Leaving that out would be a bad thing as Bob could:

  • Send Alice items without her having ordered them
  • Send items to himself or an accomplice, sticking Alice with the bill

There is an information leak with this scenario, Bob could determine if Alice is a customer of the site if he knows her email address, or he could simply make false orders as a guest until he finds an account that works. Either way he discovers a customer.

Unfortunately there's nothing you can do to prevent the activity if you want to use guest users. The best option would be to allow people to add things to their cart as a guest, but once they want to checkout force a login/registration process. That is still open to guessing, Bob could simply register and keep trying different email addresses. You can't prevent it but you could:

  • Add captchas: this isn't perfect but it does raise the bar for bots somewhat
  • Notify users when someone tries to register using their email account, at least they have some knowledge if someone is trying to steal their identity
  • When registering a user account, verification is required for the email address. But, in my scenario, when using an already registered email address as a guest, there is no verification involved: the guest order gets associated with the user, who gets a mail like "Your order 1234". – unor Dec 9 '13 at 17:07
  • 1
    That's a very bad idea, you should force authentication before any order can be placed, otherwise you are opening this up to abuse and fraud. – GdD Dec 9 '13 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.