3 ms·
Many people (most?) prefer to signup to services by email address. To do so, those email addresses must be verified. How would you verify it without sending the
by rsbadger 4y ago
Many people (most?) prefer to signup to services by email address. To do so, those email addresses must be verified. How would you verify it without sending them an email link?
- throwaway14356 4y agoa confirmation code? Also, mail might not live on the same computer.
- xboxnolifes 4y agoIt doesn't matter if it's on the same computer. Sometimes all you need to do is click the link, not do anything on the page.
- _8j50 4y agoYou can verify validity of an email like that, no issue there. Just don't use that as a factor authentication. Control over an email account should not trump passwords (what you know) or proper 2fa (what you have, typically, email can be 2fa like sms and like sms it is not a good choice). If a person proves they control an email account then you ask them for additional info like secret questions or other information configured during registration. I should not be able to take over your life because I compromised your phone which has sms, TOTP app and email.
- inopinatus 4y agooptions include: * use an interstitial page so that the actual activation is a POST request; * send a confirmation code instead of a link