I'm working on a new app, and wonder if we should verify user email address during sign up. I notice some app allow user to sign up with a fake email address e.g. abc@abc.abc, but some doesn't. What's the pro and con for allowing fake email address? Thanks
Should I implement email verification during sign up?
1–10 of 17 posts
Re: Should I implement email verification during sign up?
#2Please do. I hate getting transactional email intended for someone else because the devs don't verify email addresses. It doesn't even mean you have to do verification early in the onboarding process, but definitely before you start sending any email.
Re: Should I implement email verification during sign up?
#3It depends on what you are using the email address for. Some things you might want to use it for:
* knowing this is a real person
* marketing communication
* security/data breach communication
* forgot password flows
* step up authentication (send a code to an email)
* user lookup if one user wants to share something with another
* putting users on teams/allowing special access based on domains
If you are just looking for a globally unique identifier and aren't doing any of the other stuff, you could skip verification. But in most cases you'll want to do this.
Incidentally I hope you are using a drop in auth service or a library--there's a lot out there and no need to roll your own.
Re: Should I implement email verification during sign up?
#4It depends on what you are using the email address for. Some things you might want to use it for: * knowing this is a real person * marketing communication * security/data breach communication * forgot password flows * step up authentication (send a code to an email) * user lookup if one user wants to share something with another * putting users on teams/allowing special access based on domains In most of these cases…
And if you are allowing a fake email address, why not allow plain old anonymous access? That would be simpler and wouldn't clog up your database.
Re: Should I implement email verification during sign up?
#5Please do. I hate getting transactional email intended for someone else because the devs don't verify email addresses. It doesn't even mean you have to do verification early in the onboarding process, but definitely before you start sending any email.
Yep. I snagged a gmail address early on without numbers. I get lots of emails for people with similar initials to mine but who have some number after the name. None of them had verification messages that I could have rejected (and those that did, I safely ignored and never got spammed by).
Re: Should I implement email verification during sign up?
#6It depends what you’re building :)
But in general, always verify. You can let users in with an unverified email (better for growth), but you should still send the email and handle verification.
I’ll give you an example. Say you want to add social logins and want avoid duplicated account. You can implement auto linking. I sign up with my email, then I log in with google, if it’s the same email AND I did verify it, then you can auto link. If I didn’t verify my email, you must not.
Re: Should I implement email verification during sign up?
#7It depends on what you are using the email address for. Some things you might want to use it for: * knowing this is a real person * marketing communication * security/data breach communication * forgot password flows * step up authentication (send a code to an email) * user lookup if one user wants to share something with another * putting users on teams/allowing special access based on domains In most of these cases…
And if you are allowing a fake email address, why not allow plain old anonymous access? That would be simpler and wouldn't clog up your database.
Yeah, we are using rails devise gem to handle our login.
Re: Should I implement email verification during sign up?
#8Instead of verification, you could use the emailaddress as a login-method. Don't use passwords, but let the users login by email, sending a mail with a time-limited authentication-token and make them login that way.
That way you don't have to deal with passwords, and you will know the user has a mailbox which they control.
Re: Should I implement email verification during sign up?
#9Instead of verification, you could use the emailaddress as a login-method. Don't use passwords, but let the users login by email, sending a mail with a time-limited authentication-token and make them login that way. That way you don't have to deal with passwords, and you will know the user has a mailbox which they control.
I’ve thought about this method. I think this is what should be done for sites where you log in very infrequent (say, yearly). Do you know of any examples where this is implemented?
Re: Should I implement email verification during sign up?
#10Please do. I hate getting transactional email intended for someone else because the devs don't verify email addresses. It doesn't even mean you have to do verification early in the onboarding process, but definitely before you start sending any email.
Yep. I snagged a gmail address early on without numbers. I get lots of emails for people with similar initials to mine but who have some number after the name. None of them had verification messages that I could have rejected (and those that did, I safely ignored and never got spammed by).
same here - got my full (common enough) name while gmail was in closed invite-only beta.
I get a ton of emails for others on a weekly basis with a ton of info not meant for me to see.
One specific account "I" signed up for was a playstation account that actually prevented me from signing up for my own account. It took ~1hr of live chat with Sony to actually create an account with my email address.
(And yes I am aware I can add additional periods or +keyword to the email)