Confirm email address on signup and change

[pdurbin]

Most sites confirm your email address on signup and Dataverse should do the same: https://support.twitter.com/articles/97942-confirming-your-email-address

In a 2015-04-30 Dataverse User Accounts and Auth Meeting @mcrosas and I talked about where email addresses come from (institution vs. user-supplied). Perhaps we wouldn't need to confirm email addresses from institutions.

User-supplied email addresses should also be confirmed when the user changes them.

[pdurbin]

A user reported this issue today at https://help.hmdc.harvard.edu/Ticket/Display.html?id=216399

[kcondon]

Needed to prevent using other people's real email address to create fake accounts, see RT 225535

[bencomp]

Email addresses are necessary to allow communication with Dataverse users through the application or outside the application (e.g. for special announcements). It is then essential that the address belongs to the person claiming the address.

I trust the IdPs/IdFederation to provide email address(es) that indeed belong to the user, but in other cases confirmation is appreciated, because the information in Dataverse could be sensitive and needs to be handled only by authorised people. Email address confirmation is a small step to aid authentication.

[posixeleni]

We should also add upon sign-up that the user must enter their email address twice in the UI to confirm that this is entered correctly. At the moment we only enter an email once and that could allow for people to put in an incorrect email address (typos).

Cc/ @eaquigley

[posixeleni]

@eaquigley here are two examples of a Sign Up page (facebook and patreon) which ask you to re-enter your email when creating your account: