Email confirmations

Computer Science · Security

Follow the message

Pick who controls the inbox, then follow the route to see where it ends.

Whose inbox gets the message → What happens to the message → What the owner does

On An account is registered with an email address. 3 branches to choose from.

An account has just been registered with an email address. Who can read that inbox decides what happens next.

Predict, then check

Someone asks to reset the password on your account.

Someone presses 'Reset password' on your account. Who can complete the reset?

What you need to know

• When you register, the system sends a message to the email address you gave. It holds a unique link or code.
• You have to use it: click the link or enter the code. Only then is the account activated.
• Whoever can read that inbox is the one who can finish the job. That's the whole security idea.
• Have a goYour mate types YOUR email address into a sign-up form 'as a joke'. Whose inbox gets the link or code: theirs or yours?

  Yours. It goes to the address given, not to the person who typed it in.

  The message is sent to the address that was entered, so whoever can read that inbox is the one who can use it.

• Register with someone else's address and the message lands with the real owner, not with you.
• That message also works as an alert. The real owner finds out someone has used their address.
• Have a goA message pops up: 'Confirm your new account', for a site you've never even heard of. What has probably happened?

  Someone used your email address to register.

  The message goes to the address given, so you see it even though you didn't sign up. That's the alert working.

• Automated programs find it harder to churn out masses of fake accounts, because each account needs a message that actually gets used.
• Confirmation also guards important actions, like resetting a password or changing account details. The confirmation goes to the account holder's email.
• A completed confirmation does not prove who someone is. It proves they could access that email account.
• Have a goTrue or false: 'The link was clicked, so the site now knows exactly who is behind the account.'

  False. It only knows that someone could use that email account.

  Using the link shows access to the inbox. It says nothing about who the person actually is.

• So it is only as secure as the email account. An attacker who can read the victim's inbox can complete it too.

The big picture

An email confirmation sends a message with a unique link or code to the address given when someone registers, and the user has to use it. Only whoever can read that inbox can finish the job, which blocks accounts made with someone else's address and makes it harder for automated programs to create fake accounts. It also protects important actions and alerts the real owner. But it proves access to an email account, not who someone is, so it is only as secure as that email account.

⚠ Watch out

Writing that email confirmation proves who someone is, or that the account is now safe from misuse. It only shows that someone could use that email account.

Memory hook

Follow the message. It lands in one inbox, so only the person who can read that inbox can finish the job. The same email that lets the real owner in is the warning that someone else tried.

Check yourself

A site shows a 'Reset password' button. In one sentence, explain why it sends the reset link to the account holder's email address instead of just showing it on screen.