Email confirmation techniques in major sites

Question

The way I understood traditionally for email confirmations to work is the user registers to the site with their email and then to login they must verify their email.

If they have not verified their email they simply cannot log in. I noticed some major website for instance allow you to register and login without email verification.

For instance, Twitter allows you to register, once you register it logs you in. There is a message displayed you must verify your email to use the site, but the site is still usable without it.

Facebook also has a similar procedure where you can login without verifying. Most of the features are available too, such as being able to write to the servers (posts tweets and statuses), and read information.

My question is what could be the thought process here? If you allow for people to login without verifying, what is the point of email verification? How does email verification then provide much extra security?

Answer 1

Email verification doesn't provide extra security. It just validates than the newly registered user is the legitimate owner of that email address.

For security concern a best practice for a web site would be not to send any email to an unconfirmed email address. This prevent leaking information to someone who mistyped his email address.

Anyhow you should encourage users to confirm their email address quickly : very often the email address is the primary way to recover a lost password. A user with an unconfirmed email address and a lost password would be screwed up if there is no alternate way to recover his password.

Moreover, if the mistyped email address is actually the address of someone else, this person may confirm the email address and use the password recovery to get access to the user original account.

Answer 2

The purpose of the email verification for most services is to ensure user uniqueness (and thereby, hopefully, humanity) so that the provider can resist having many legions of spam accounts set up with ease (it's still possible, just more difficult). In getting a response, the service can then deny any future users from that email address from having a unique account, and not have to use any special technique of their own to do so (the kind a reputable domain would use, like sending a SMS or gasp charging for service.)

You are thinking of it as a way to validate user identity/authenticity, which is not really the point of an email "verification" despite the pretenses. To do that, a site would employ either a way to check a user against free information sources (court records, etc) or more popularly they would use a credit-report style set of questions. For the most part, the site could care less who you are or if you are who you say you are, as long as you aren't going to spam via their service (since making money off eyeballs is their job.)

To your exact question, once the email address is attributed to the account the work is done, and the verification is just for later if/when there is some question as to the user's uniqueness.

Answer 3

Email verification stops spam and validates that user have this email. Before you send user an email message (or some confidental message like bank), you know that you are sending this message to this user, who has not mistaken in writing the adress, and nobody else.