Let's say I have a site where users can log in with Google+ or Twitter. Now imagine a user called Bob going through the following steps:

  1. Sign in to my site using their twitter account. I request their email address from Twitter, and get [email protected].
  2. After performing some actions, Bob logsout.
  3. Some time later, Bob comes to the site again, but forgets that he has an account with twitter, and signs in with Google+. He looks like a new user to me, so I request the email address from Google+, and get [email protected].

So now, my app can detect that there are two users with the same email address. Would it be ok for me to pop up a message saying "Hey, it ooks like you already have an account on this site, linked to your twitter account. Log in with twitter to merge this account with your old account."?

  • only if the other provider fully validates the email address... Commented Feb 2, 2015 at 16:42
  • 1
    I think all major providers do, don't they? I'm sure facebook, Twitter, G+ do, and I would be surprised if others like LinkedIn or GitHub didn't.
    – bigblind
    Commented Feb 2, 2015 at 16:44
  • 1
    Do they still provide an unvalidated email to your API? What if the email [email protected] expired due to inactivity and someone else registered it (but the the twitter account still exists attached to the original owner)? The good thing is that you seem to require the original log in in order to merge the account.
    – Ángel
    Commented Feb 2, 2015 at 16:57
  • yes, I would require a signin using both providers in order to merge the accounts.
    – bigblind
    Commented Feb 2, 2015 at 17:00

1 Answer 1


Only if you can validate that it is truly Bob logging in. Otherwise, you're handing a ton of data and power over to fake Bob.

A better step would be "Hey, is this you? Login in with Twitter/your other creds to merge your account." That way, an attacker would have to know Twitter creds AND G+ creds to roll the accounts together. If they do, then poor Bob is screwed either way, and if it really is Bob, he can just go "oh, that's right!" and present the Twitter credentials.

Of course, this presents a usability and UI challenge, but I have the UX skills of a pebble.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .