A typical account creation process seems to be:
- Provide email address and set a password
- Receive confirmation email with a link and/or hashed token
- Click the link to verify and/or enter the token on the site
However, I once read somewhere (and I can't find this now, which is why I'm asking) that a better process would modify Step 3 to also require the user to login using the password provided in Step 1. I think the rationale was that this extra precaution ensures that the person verifying the email address is the same person who created the account.
Question: does the above explanation make sense, and should I implement email verification by requiring password-based login?
It makes some sense to me, and at least it doesn't seem harmful -- other than making the user experience slightly more cumbersome. But I see many online services that do not require this, and I wonder why.
For example, here's the scenario I worry about. What if person #1 initially created the account but specified the wrong email address (maliciously or accidentally), and it got sent to person #2. If person #2 is naive, he/she might verify that email address by just clicking the link... and then forget about it. Then person #1 could still login using the password. Suppose person #1 does all sorts of bad stuff on that account. Would person #2 be responsible?
I think an alternative solution might be to ask new users to first specify just an email address, then confirm that with a hashed token, and then ask them to set a password. But I don't see very many online services that do it this way, either.