We have email, or nicknames previously, as an identity verification.
But what happens in account creation process or a registration when your first and last name it the identity?
We are
remaking anonline publication, smaller, local, but with such a history I remember that magazine in paper form on my grandma's coffee table.
They chose their printed magazine subscription partner
to also hold their users and
new subscriptions.
(Can't share details, the project's not out yet)
The registration
process
So, when user registeres, it goes to our server and from there, we send request to the partner's servers. We have ZERO control there.
Which that alone I don't like.
We started to receive previous registration attemps as existing users. That's strange, right? We are of course testing different email addresses, even different phone numbers.
I contacted their IT. The respons: "You keep sending 'test test' as a name, so we connect it to existing 'test test' customer and add the new contacts to them.".
That's scary! Security, privacy scary.
There is a way to be a little safer. Like asking for existing customer first, then registering.
But it doesn't solve all the John Does.
What's the problem exactly
First is - you never trust someone connecting to you API! If we were dumb or just an error, a mistake happens, we can very easily place a very different contact to a customer and the partner may send my invoice to a stranger's email. Huge privacy issue.
Second, there are so many people with the same name. By taking names as identifications, the only identifications as it turned out, they literally prevent multiple people with the same name creating an account.
Now I have strong doubts about security of the users and voiced it to our client.
Comments