Best practices for email security

Question

I writing a security layer for my app and I would like your input on updating users' email addresses (also used for the login).

I'm interested to hear from anyone who has written an application with similar requirements. How would you go about it? Here are some ways I thought of, but I suspect I'm missing something:

Approach one

1. Update the address and send a confirmation email to the new address
2. If address is not confirmed with 48 hours, suspend it
   • It's easy.
   • If new address is wrong, the user gets locked out of account.
   • Someone can hijack the account by changing the user's address.

Approach two

1. Update the address and store the old value temporarily
2. Send a notification email to the old address with an option to revoke the change
3. Send a confirmation email to the new address
4. I restore the old address if the user revokes the change (through the notification email)

5. If the change is not revoked, but the new address is not confirmed within 48 hours, I suspend the account.

   • Secure
   • A lot more work

Approach three

1. Do not update the address but store the new value temporarily
2. Send a confirmation email to the old address asking to confirm the change.
3. If the change is confirmed, carry out the update and send a confirmation email to the new address.

4. If new address is not confirmed with 48 hours, suspend the account.

   • Secure
   • A lot more work

It's best to be as secure as possible, but I don't want to put the user off by giving them 1001 things to do just to change an email address.

They might also have secondary email addresses, not used for login, but for other purposes, and I'm not sure how to handle updates to those addresses. Ideas are welcomed.

Answer 1

If you trust your login mechanism, and users can only change their emails while logged in, then simply:

1. Update the email address.
2. Notify the user on the website.
3. Send an email notification to the old email address about a change, including a link to report any problems.

Otherwise, use your Approach three, but without point 4. Also, in this case, send notification about the update to both email addresses.

Answer 2

My conclusion is essentially the same as Darthenius's.

I don't understand why you always lock the account if they don't follow up. That doesn't seem secure: there's a big risk of lockout.

Any approach that requires access to the old address fails to handle the case when the user is changing his address precisely because he no longer has access to the old address. This is a common case: first you lose access to an email address, and then you realize there are a dozen places that still use it.

Ideally, both email addresses should remain valid until the change of address is confirmed. It is common to lose access to an address, but less common that this address is reattributed immediately (usually, it's an institutional address that you lose because you lose your job, studentship, …).

If you can only have a single address, then treat the old address as valid until the new address has been confirmed. Do nothing if the new address is not confirmed. This is your approach three, only without the lockout. It's not much work: all you need is one pending address change record, which the confirmation code from the confirmation email triggers.

Primary or secondary email address doesn't really enter into the picture.