4 ms·

Most people will not encounter this problem. - website that use a username as the primary identifier will make it clear that the email address has not yet been

• iopq 10y ago
  What if someone did confirm the email address after they received the email? Now they can take over your account at any point in time.
  • cstejerean 10y ago
    Confirming the email requires logging in. If you are already logged in then your session might be sufficient, but if you open the confirmation link on another device (like your phone) it will ask you to log in.
    • officialjunk 10y ago
      And then request a password reset email to take over.
  • koliber 10y ago
    There are ways of handling this well. I'll address two common situations: If the site uses the email address as the primary identifier and there is no separate username, it is OK if someone confirms a mistyped email address. In such situations, an account should not be created until the email address is confirmed. Let's say matt@gmail.com is sitting in front of the computer and creates an account for mattt@gmail.com. mattt@gmail.com confirms the email address and is now the owner & controller of that user account. matt@gmail.com does not have access to that account, nor did he get a confirmation email. Ideally, he will realize something is wrong and will try creating the account again. If the site uses a username, and the email is just a contact method, the process of confirming the email address should ask the user to re-enter the password.
• crottypeter 10y ago
  >> difficult for the user to not notice an unverified email address There are always users who exceed your expectations.
  • koliber 10y ago
    Indeed. Luckily, they are not most users.
    • ldjb 10y ago
      In my experience, as someone who has a lot of dealings with users, I've found that users are very goal-oriented. They have a particular task they want to complete, and they just want to get on with it. A website may prompt for email confirmation, but if confirming their email is not actually necessary for them to complete the task at hand, there's not much incentive to do it.
      • koliber 10y ago
        Absolutely. A website needs to make a determination how important it is for them to have a verified email address. If the email address is used only for notification or marketing purposes, then there it should not put too much pressure on the user to validate the email address. If, on the other hand, the email address is required for something important, such as password recovery, it should make a concerted effort to get a user to provide one.
        • DanBC 10y ago
          > If the email address is used only for notification or marketing purposes, then there it should not put too much pressure on the user to validate the email address. You must verify the address -confirm the opt-in- before you start to send stuff to it. If you don't you're spamming.
          • ldjb 10y ago
            It's interesting how it's common practice to ensure email addresses are confirmed before sending marketing messages to them, whereas there doesn't seem to be such a requirement for telephone numbers or postal addresses.
• nodesocket 10y ago
  Agree with all your points, but I actually really like the idea of having the signup form only ask for e-mail. Do the confirmation song and dance, and then ask for the rest of the users details (name, password, etc).
  • koliber 10y ago
    Absolutely! If done right, the workflow you suggest takes a lot of friction out of the registration process. You can do even better! You can just let a user start using your application without even providing an email address. Keep track of the user via a cookie at first. Present them with opportunities to provide an email address (and other info) if they wish to return in the future. Once they do, associate the account with the email address. After that, continue asking for more information on a need-to-know basis.
    • nodesocket 10y ago
      > You can do even better! You can just let a user start using your application without even providing an email address. Keep track of a user via a cookie. This is not better from a business 101 perspective. You've just traded the ability to communicate with some of your users without requiring their e-mail.
      • ldjb 10y ago
        It depends on the business/service. In some cases it's a good idea to give the user a taster of what they can do with the service before making them sign up. You know what I do when I come across a service that forces me to sign up before I can see if it's any good? I hit the back button.
        • koliber 10y ago
          You are not the only one! The taster can be in the form of a descriptive home page, landing page, or article. It could also be in the form of a completely friction-less trial that does not ask for any user info. The latter are rare. It's up to the user to decide if they should invest their time in trying out the product based on whatever taster the website offers.