What is the best policy for allowing clients to change email?
- by Steve Konves
We are developing a web application with a fairly standard registration process which requires a client/user to verify their email address before they are allowed to use the site. The site also allows users to change their email address after verification (with a re-type email field, as well).
What are the pros and cons of having the user re-verify their email. Is this even needed?
EDIT:
Summary of answers and comments below:
"Over-verification annoys people, so don't use it unless critical
Use a "re-type email" field to prevent typos
Beware of overwriting known good data with potentially good data
Send email to old for notification; to new for verification
Don't assume that the user still has access to the old email
Identify impact of incorrect email if account is compromised
