3 ms·
The role of email verification is as a simple check for whether the email entered is controlled by the user entering it. A non-reponse by the owner of the email
by nomilk 4y ago
The role of email verification is as a simple check for whether the email entered is controlled by the user entering it. A non-reponse by the owner of the email implies denial. So it's denial by default, and that only changes if specific action is taken (i.e. clicking on the confirmation link).
I suspect the reason for not having an explicit 'deny' button is based on cost-benefit analysis. The benefits might be limited to 1. Improved user satisfaction, and 2. Minimise the risk that a user might accidentally click the confirmation link. But I suspect these aren't enough to outweigh the extra (arguably unnecessary) effort of implementing it.
- NikolaNovak 4y agoThat works in principle. It does not seem to work in practice. I get a huge amount of daily email from various registered accounts with "unverified email". I assume somewhere on an ignored dashboard user sees a "unverified email" note, but it certainly does not, on average, stop the business from continued use of unverified email - and again, I've experienced this for small and large businesses alike.
- dragonwriter 4y ago> The role of email verification is as a simple check for whether the email entered is controlled by the user entering it. A non-reponse by the owner of the email implies denial It doesn't, though, because services often have a limited pending verification state, and no negative exit from that state. If it actually implied denial, then at some time in the pending state without confirmation, it would enter a failure state (which would probably curtail most access until a new email was provided.) Even then, it would be desirable to allow the actual mail account owner to trigger a fast-denial rather than relying on a implied denial by timeout.