1

I am planning to start a new asp.net core MVC web application. One of the features we are having is that anonymous users can register inside our web application by entering their email addresses. then our system will send them a confirmation email, to activate their accounts.

Now by default the system will show error message, in-case a user try to register using existing email address, even if the existing email address was not confirmed. now this will pose a major problem in our system, is that hackers can use others' email addressees, and prevent them from registering inside our web application. Our web application is a CRM-like for real estate companies, and hackers can try to add as many email addresses has they want, they can get these email addresses from the companies' web sites such as info@.., contact@..., admin@.. , etc. So is there any problem if I do the following modifications:-

  1. If the user did not confirm the email address in 1 hour, then the system will automatically remove his email address?
  2. When I want to check if an email address is unique to check only the approved email addresses.
  • How much time does someone have to confirm their email address? – Robert Harvey Apr 18 at 14:32
  • 4
    My suggestion would be to expire unconfirmed emails after an hour. – Robert Harvey Apr 18 at 14:35
  • 5
    One thing to keep in mind is that if "hackers" try to fraudulently register info@ somecompany.com in an attempt to lock out somecompany, but the actual owner of info@ gets the confirmation email you send, then they're not really locked out of your site, are they? The reason this scenario rarely happens is that it doesn't have the effect that the hacker desires and that you're concerned about. Having said that, building in the pending email expiration is still an ok thing to do. – Eric King Apr 18 at 14:43
  • 1
    Actually the hack to be concerned about here isn't hacker A pretending to be new user B. It's hacker A pretending to be new users B to ZZZZZZ and getting you added to the email spammers black list so no one knows someone is pretending to be them. – candied_orange Apr 18 at 14:50
  • 3
    A confirmation email system exposes a resource unsecured. It has to since it's how you build a secure relationship. That unsecured resource gives anyone the ability to make you send emails. Since you can't secure that with authentication you need to throttle it to reasonable levels to prevent getting blacklisted. – candied_orange Apr 18 at 14:55
7

The purpose of verifying the email address is to obtain proof that the owner of the email address and the user who registered are the same person. It therefore follows, that the logical thing to do if an email address remains unverified for a significant length of time, that the user who registered is not actually the owner of that account, or you have reason to doubt that it is the case.

If the user did not confirm the email address in 1 hour, then the system will automatically remove his email address?

If your registration process is fully automated and quick, a there should be no problem with that. If your registration process is slow or involves manual intervention, 1 hour may not be enough time. But, if you have manual intervention in the registration process, then you don't need a waiting period if a human can spot a large number of bogus registrations and deal with them.

When I want to check if an email address is unique to check only the approved email addresses.

In that case, it is possible for two users to start the registration process with the same email address. One of them could complete verification before the other one, so how do you handle the second user? You may say that "well, only one of them has the email address legitimately" but what if the same person tries to register two users by mistake? Or sends one registration, decides to change the username or something, so registers again, gets two emails, and picks the one for the username they didn't want? It sounds silly but users can be silly, especially non-technical users.

I would avoid having to handle those failure modes by saying whoever registers first gets to keep it, provided they have verified. If there's a 1 hour period where a legitimate user can't register with their real address, then it's really not that big of a deal, especially if you allow users to change the email addresses associated with their accounts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.