News for hackers. Stuff that matters.

A comment on The Correct Way to Validate Email Addresses. Parent comment

Re:The Correct Way to Validate Email Addresses by lucb1e on Thursday September 08, 2016 @07:37AM (#12452077)
> The best emails are the ones who extend full trust to the email recipient over some account during that first email. [Random company,] shame on you.

Well what else would you have them do? Have people enter their address and send letters there to do a password reset?

A confirmation email before full trust is going to do little: a malicious person would just click that link, right?

[ Parent | on HN ]
Re:The Correct Way to Validate Email Addresses by wyldfire on Thursday September 08, 2016 @09:12AM (#12452612)
Someone could have just created an account and accidentally put the wrong email address in. Therefore, putting a link that extends full trust in the welcome/confirmation email is a design error. The fix for this error is to require the newly created account holder to put in their password on this first login. While the account's in this state it shouldn't be possible to reset the password.
[ Parent | on HN ]