Re:What percentage of users activate their accounts?
by sanj on Monday December 10, 2007 @12:53PM
(#87868)
Not doing it can lead to email hijacking:
Consider someone signing up with my email address: [email protected]. Now I'm not going to be able to use that email address, because it is already taken. Worse, if messages to that account, such as invitations, the attacker can accept them, since they typically see the invitations on the site in addition to it being sent to the email address.
As the legit user, I might see the invites, but won't be able to log in at all. Worse things can happen: once the attacker signs up, they could make this email address secondary and add another, primary address so that they see all of the messages.
Consider someone signing up with my email address: [email protected]. Now I'm not going to be able to use that email address, because it is already taken. Worse, if messages to that account, such as invitations, the attacker can accept them, since they typically see the invitations on the site in addition to it being sent to the email address.
As the legit user, I might see the invites, but won't be able to log in at all. Worse things can happen: once the attacker signs up, they could make this email address secondary and add another, primary address so that they see all of the messages.