Suppose I have an email address abcd1234#gmail.com, I would like to check whether this email address has been used in Apple,Facebook,Twitter and so on. (used means it has been registered as an account).
How to do it with programming? It there any open API ? Any language will be fine.
No. A feature like this would be a security risk, because finding valid account email addresses is the first step in getting control over the account (second step is retrieving the password from somewhere).
There is no such api, this seems to be really unsecure thing.
The way I can see for you to do this – try to register a new account with this e-mail address, and view the result.
Related
I am implementing an email verification service, with the purpose of confirming that the person registering is indeed the owner of that email address (specifically, that they work at the organisation that the email domain belongs to).
I will send an email post-registration with a single-use link in it that will set their status to verified = 1.
Users can choose to register and log-in using either a simple email/password combination, or by using the Google Sign In service.
My question is: do I need to verify the ones that have registered with Google Sign In? In order to provide their email address to me, they had to sign in with Google, who then confirmed the address. Is there anything I've missed here, or can I immediately consider these users to be the verified owners of these addresses?
If you are using google sign in there is no need to verify the user.
Whereas if have your own login system, then you must verify the email because
if the email is not verified then you cannot have forgotten password feature through email
and also the user might not have actually had the email so anyone else could create the same email and if you have forgotten password through email someone else could easily access others data.
I'm using Register with Facebook as one of the ways to log in to my web app, and expressly ask for the "email" permission..
On login, some of the user data ($facebook->api('/me')) is stored into the users database, however, sometimes the email field just doesn't exist - is this a common problem?
Just a guess...
The facebook documentation says:
note: this field will not be returned if no valid email address is available for the user
Source: https://developers.facebook.com/docs/reference/api/user/
So when an email address become invalid (users who haven't used facebook in years and have destroyed/changed their email address since for example), facebook may stop returning this field.
5% of invalid address may sounds big, but if I check my facebook friends, I think more than 5% of them never use their account, and I wouldn't be surprised if the address they used when they signed in is now invalid.
Users don't always have to provide an email address in order to use Facebook. They can also sign up via SMS, though it's far less common.
In short, FB won't always have an email address, so can't serve it to your app.
Try:
// Just to make sure email are permitted
//$facebook->getLoginUrl(array('req_perms' => 'email'))
// Request email
FB.api('/me?scope=email', function(response) { /*...*/ });
Or:
$email = $facebook->api('user_id?fields=email');
PROBLEMS:
The user changed the visibility of its email address to "only me" and thus you have no way to get it.
The user registered with SMS instead of email as mentioned in the previous answer.
ALTERNATIVE:
If you absolutely need to contact the user but you cannot get its email address nyou can still get its Facebook email (everybody has this email): "user_name#facebook.com".
If the user uses a POP server he will directly receive the email in GMail or others, if not he will receive your email as a private message. The only drawback if this method is that your email must be "plain/text" and not "HTML".
One thing is Users don't always have to provide an email address in order to use Facebook(could have registered through mobile)- as mentioned by Colm. Apart from this-
Please check that if the user has definitely granted you the email extended permission or it hasn't subsequently been revoked. To have a check on this you could use the permissions api-
/USER/permissions
I had similar problem & I found the cause for this. This problem occurs for users who have not set their Primary Email Address (They have many email address but they haven’t pointed out which is their primary email address) under General Account setting tab.
I tried using such accounts on various famous sites which has Facebook login & even they couldn’t retrieve the email address from such accounts.
So, its not the problem with the code(Assuming u have asked for permissions). We just have to handle such scenarios & let users know that we didn’t receive their email address. Like Klout does.
Thanks
In addition to what #Jigar Jain wrote above, users can actually uncheck the email permission during the sign inflow. If that's the case, his/her email address will not be returned by Facebook.
It's up to you to implement a logic that makes login unsuccessful if user unchecks the email permission, to force your users to choose another login method that will guarantee that a return of user's email address.
It is not mandatory for someone to give their email address while signing up with Facebook. An alternate approach would be to ask the user to link their email id in the Facebook account settings. That way you can fetch the email id, if that's a mandatory field in your DB. Otherwise you can continue with the id provided by FB which is unique.
my question is about the workflow of a web registration.
1) register with email + basic data
2) activate the account with a special secret link <- is this necessary?
3) allow the user to log in to the system
EDIT: I want to make the process as simple as possible without a password to choose/remember.
In more detail:
After a user is registering on a web site I sent out a confirmation with a generated password to login on the site and proceed.
Many sites sent an activation link first and then allow logging in to the system.
Is there any reason to do this additional step when I generate the password and sent it out to the user?
Thanks for your answers.
Is there any reason to do this additional step when I generate the password and sent it out to the user?
To ensure that the provided email address exists, and belongs to the person who registered the account.
I've noticed an increasing number of websites which skip this step. It seems to be a trend.
The purpose of the activation link is to guarentee that the email address provided by the user is one to which they have access. If you are generating a password and sending it via email to the user's email address, then the link is not required (because them logging in means that they read your email).
However, email is generally not a secure way to distribute information over the internet. You are sending them the password in plaintext, and you do not know how many people have access to that email account (e.g. a shared family account). I think you would be better off allowing the user to choose their own password at registration and then send them a link (offer to generate a password for them on the registration page, if you really believe that generating it is better).
The validation of an email account is usually to help prevent someone creating numerous accounts. This helps prevents spammers and various other bad people from attacking your site from different accounts.
In general you're trying to ensure that the person is who they say they are and that you have an outside means of communicating with them.
1 - to ensure that the email is belong to the registerd user.
2 - to make it harder to the people want to create many accounts (like forums where a single person have so many accounts to use them in voting or somthing).
I remembered a funny site that gives you a 10 minutes email , just to skip the process of creating a new email or even spamming your email by the sites you've registered in.
This way you make sure that the email address is valid and it will be more difficult for a spider to generate many users than without this step. Also, you might do a lot of things in your database when a user is registered and you can do these after the user is validated, to save time by not creating extra traffic on your database server for fake users.
At the moment, we are sending an email address verification email each time someone signs up. This email has been causing a number of problems: people don't get it, they just don't click the link in the email or the email gets block by spam or some other method. We are working on resolving the spam issue, although I don't think it's possible to completely resolve it.
I'm wondering what other methods there might be for verifying and email address. Is there any other way to verify an email address without sending an email? Or is there another method of ensuring people aren't signing up with fake information?
I'm not sure if there are other good methods, but sending an email and having them click a link is definitely the simplest and most accurate.
A main feature to sending that email, is for the person to verify that it's actually them that requested it.
The only way to verify someone owns an email address is to have him use it.
As for verifying users don't enter fake information - not even sending an email can help. With so many disposable/temporary email services out there (like GuerrillaMail) , someone can fill up your form with false info, post a temp email address, log to that address and click the link in your email - manually or programatically.
You have to trust your users to come back for your content, and ignore spammers.
strikeiron.com offers a paid web service to verify if an email exists without sending a message to that email. try it out here is the link: strick
http://www.strikeiron.com/Catalog/ProductDetail.aspx?pv=5.0.0&pn=Email+Verification
I'm building a system that allows people to submit text and photos via email in addition to standard access on the website. I'm trying to weight the security advantages of two strategies in particular for verifying submissions from a user. Here they are as follows:
To based auth: Create a secret email address per user and present this to the user for submission. This strategy has the advantage that people can send from multiple devices that might be setup with different mail accounts
From based auth: Only accept emails from addresses that are registered in the user database. The idea being that it is impractical/difficult to impersonate registered users based on the sending address.
Can you think of other possible solutions? Which strategy of the ones proposed makes the most sense to you?
I would suggest that you not use From based authentication, at least not without some additional credentials (a passphrase, etc)
It's way too easy to forge, and certainly not difficult if you know someone's email address.
If you echo the email back to the user for confirmation, you can make things a little more difficult, but realize that your service can end up being used as a sort of spamming relay. (I could send 100 upload requests to you, with a forged FROM address, and you'd go ahead and spam the real person with 100 confirmation requests)
The better option is to check the registered email address but add the need for a code within the email subject known to the user. This way if they forge the email from address, they would still need a key to authenticate the incoming email.
I would go with "from" + confirmation, to avoid forging.
I.e. receive the email, but send a response with auth token in the subject line (or in the body) back to the "from" address. The user either will need reply, or click a link to confirm the submission.
And you post the content only after confirmation.