This question may be related to this one, but I think we need to be sure.
My website implement login via OpenID (or Google, or Facebook, etc.).
On my website, authorization is based on user email adress. If user has email email@example.com, she gets access to the content linked to that email address. (Basically in my case, content sent by other users to her email address.)
I do not provide other ways to login than third party auth and single use token. User sometimes connect via OpenID sometimes via token.
I guess when new user login for the first time via OpenID, I should in fact verify that she really owns the email address ? Then only, I can store the provider as "trusted" for this email address.
Does anything prevent anyone to set up an OpenID provider, to make it provide someone else email address, and to get privileges linked to this email address on my website ? Can I make a list of "trusted" providers (like Launchpad.net, Facebook, Google) which are known to verify user email address ?
I am pretty sure about the answer, but I need a confirmation. I want to make my login system as light as possible especially for new users. So I would not like to add tasks for the user if it is not mandatory.