Customers e-mail verification to complete registration

[Bruno Busco]

Hi,
I am looking into OFBiz for the new customer email verification.
What I am looking for is the standard feature that sends to the new
customers a confirmation e-mail with a link that must be used to login and
complete the registration process.
In my actual installation I get new customers enabled soon without this
check.
Is there some way to enable the check?

Many thanks,
Bruno

[BJ Freeman]

clarification:
are you saying the password notification email is not working
or
you would like a different way for it to work.


Bruno Busco sent the following on 9/28/2008 12:01 AM:

> Hi,
> I am looking into OFBiz for the new customer email verification.
> What I am looking for is the standard feature that sends to the new
> customers a confirmation e-mail with a link that must be used to login and
> complete the registration process.
> In my actual installation I get new customers enabled soon without this
> check.
> Is there some way to enable the check?
>
> Many thanks,
> Bruno
>

[Bruno Busco]

Hi BJ,
what is the "password notification email"?
If you mean the "forgot password" feature that let the user have the
password changed and emailed, I am ok with this. The forgot password is
correctly working.
What I mean for e-mail verification is the feature that is intended to
ensure that the new customer is providing a real e-mail before enabling him
to the access to the site.
I cannot find how to enable this feature. Actually, in my installation, when
a customer registers himself he his directly logged in even if he has input
a wrong e-mail. I would like OFBiz to send him a registration confirmation
e-mail with a link that must be used to enable the account.
Not enabled account for a certain amount of time should be deleted.
Is this feature available in OFBiz?
Thank you,
Bruno



2008/9/28 BJ Freeman <[hidden email]>

> clarification:
> are you saying the password notification email is not working
> or
> you would like a different way for it to work.
>
>
> Bruno Busco sent the following on 9/28/2008 12:01 AM:
> > Hi,
> > I am looking into OFBiz for the new customer email verification.
> > What I am looking for is the standard feature that sends to the new
> > customers a confirmation e-mail with a link that must be used to login
> and
> > complete the registration process.
> > In my actual installation I get new customers enabled soon without this
> > check.
> > Is there some way to enable the check?
> >
> > Many thanks,
> > Bruno
> >
>
>

[Jacques Le Roux]

Bruno,

I don't think this feature exists in OFBiz OOTB. At least, I'm quite sure at the UI level.
Please, feel free to open a Jira issue and provide a patch.

Jacques

From: "Bruno Busco" <[hidden email]>

> Hi BJ,
> what is the "password notification email"?
> If you mean the "forgot password" feature that let the user have the
> password changed and emailed, I am ok with this. The forgot password is
> correctly working.
> What I mean for e-mail verification is the feature that is intended to
> ensure that the new customer is providing a real e-mail before enabling him
> to the access to the site.
> I cannot find how to enable this feature. Actually, in my installation, when
> a customer registers himself he his directly logged in even if he has input
> a wrong e-mail. I would like OFBiz to send him a registration confirmation
> e-mail with a link that must be used to enable the account.
> Not enabled account for a certain amount of time should be deleted.
> Is this feature available in OFBiz?
> Thank you,
> Bruno
>
>
>
> 2008/9/28 BJ Freeman <[hidden email]>
>
>> clarification:
>> are you saying the password notification email is not working
>> or
>> you would like a different way for it to work.
>>
>>
>> Bruno Busco sent the following on 9/28/2008 12:01 AM:
>> > Hi,
>> > I am looking into OFBiz for the new customer email verification.
>> > What I am looking for is the standard feature that sends to the new
>> > customers a confirmation e-mail with a link that must be used to login
>> and
>> > complete the registration process.
>> > In my actual installation I get new customers enabled soon without this
>> > check.
>> > Is there some way to enable the check?
>> >
>> > Many thanks,
>> > Bruno
>> >
>>
>>
>

[BJ Freeman]

there is one in ProductStoreEmailSetting PARTY_REGIS_CONFIRM
service sendCreatePartyEmailNotification.
this sends them a email with a login.
Maybe modify the code so they can login with a temporary password but
then are send verification password in the email.
then you have
PRDS_EMAIL_VERIFY
service sendVerifyEmailAddressNotification
used in when someone uses the addes an email to notifications.
that can be modified with a conditional to add your requirements.

Bruno Busco sent the following on 9/28/2008 4:03 AM:

> Hi BJ,
> what is the "password notification email"?
> If you mean the "forgot password" feature that let the user have the
> password changed and emailed, I am ok with this. The forgot password is
> correctly working.
> What I mean for e-mail verification is the feature that is intended to
> ensure that the new customer is providing a real e-mail before enabling him
> to the access to the site.
> I cannot find how to enable this feature. Actually, in my installation, when
> a customer registers himself he his directly logged in even if he has input
> a wrong e-mail. I would like OFBiz to send him a registration confirmation
> e-mail with a link that must be used to enable the account.
> Not enabled account for a certain amount of time should be deleted.
> Is this feature available in OFBiz?
> Thank you,
> Bruno
>
>
>
> 2008/9/28 BJ Freeman <[hidden email]>
>
>> clarification:
>> are you saying the password notification email is not working
>> or
>> you would like a different way for it to work.
>>
>>
>> Bruno Busco sent the following on 9/28/2008 12:01 AM:
>>> Hi,
>>> I am looking into OFBiz for the new customer email verification.
>>> What I am looking for is the standard feature that sends to the new
>>> customers a confirmation e-mail with a link that must be used to login
>> and
>>> complete the registration process.
>>> In my actual installation I get new customers enabled soon without this
>>> check.
>>> Is there some way to enable the check?
>>>
>>> Many thanks,
>>> Bruno
>>>
>>
>

[Bruno Busco]

Jacques,
for the moment I have done the easy part of your suggestion! ;-)
*OFBIZ-1977 <https://issues.apache.org/jira/browse/OFBIZ-1977>*

2008/9/28 Jacques Le Roux <[hidden email]>

> Bruno,
>
> I don't think this feature exists in OFBiz OOTB. At least, I'm quite sure
> at the UI level.
> Please, feel free to open a Jira issue and provide a patch.
>
> Jacques
>
> From: "Bruno Busco" <[hidden email]>
>
>  Hi BJ,
>> what is the "password notification email"?
>> If you mean the "forgot password" feature that let the user have the
>> password changed and emailed, I am ok with this. The forgot password is
>> correctly working.
>> What I mean for e-mail verification is the feature that is intended to
>> ensure that the new customer is providing a real e-mail before enabling
>> him
>> to the access to the site.
>> I cannot find how to enable this feature. Actually, in my installation,
>> when
>> a customer registers himself he his directly logged in even if he has
>> input
>> a wrong e-mail. I would like OFBiz to send him a registration confirmation
>> e-mail with a link that must be used to enable the account.
>> Not enabled account for a certain amount of time should be deleted.
>> Is this feature available in OFBiz?
>> Thank you,
>> Bruno
>>
>>
>>
>> 2008/9/28 BJ Freeman <[hidden email]>
>>
>>  clarification:
>>> are you saying the password notification email is not working
>>> or
>>> you would like a different way for it to work.
>>>
>>>
>>> Bruno Busco sent the following on 9/28/2008 12:01 AM:
>>> > Hi,
>>> > I am looking into OFBiz for the new customer email verification.
>>> > What I am looking for is the standard feature that sends to the new
>>> > customers a confirmation e-mail with a link that must be used to login
>>> and
>>> > complete the registration process.
>>> > In my actual installation I get new customers enabled soon without this
>>> > check.
>>> > Is there some way to enable the check?
>>> >
>>> > Many thanks,
>>> > Bruno
>>> >
>>>
>>>
>>>
>>

[Jacques Le Roux]

As often I forgot the rule : if you have no patch to submit, please use 1st the dev. ML preferably than discuss the subject in the
Jira issue.
This "rule" was suggested by Jacopo. Actually on my side I see no problem to discuss directly in Jira issues. But jacopo will
certainly explain why...

Jacques

From: "Bruno Busco" <[hidden email]>

> Jacques,
> for the moment I have done the easy part of your suggestion! ;-)
> *OFBIZ-1977 <https://issues.apache.org/jira/browse/OFBIZ-1977>*
>
> 2008/9/28 Jacques Le Roux <[hidden email]>
>
>> Bruno,
>>
>> I don't think this feature exists in OFBiz OOTB. At least, I'm quite sure
>> at the UI level.
>> Please, feel free to open a Jira issue and provide a patch.
>>
>> Jacques
>>
>> From: "Bruno Busco" <[hidden email]>
>>
>>  Hi BJ,
>>> what is the "password notification email"?
>>> If you mean the "forgot password" feature that let the user have the
>>> password changed and emailed, I am ok with this. The forgot password is
>>> correctly working.
>>> What I mean for e-mail verification is the feature that is intended to
>>> ensure that the new customer is providing a real e-mail before enabling
>>> him
>>> to the access to the site.
>>> I cannot find how to enable this feature. Actually, in my installation,
>>> when
>>> a customer registers himself he his directly logged in even if he has
>>> input
>>> a wrong e-mail. I would like OFBiz to send him a registration confirmation
>>> e-mail with a link that must be used to enable the account.
>>> Not enabled account for a certain amount of time should be deleted.
>>> Is this feature available in OFBiz?
>>> Thank you,
>>> Bruno
>>>
>>>
>>>
>>> 2008/9/28 BJ Freeman <[hidden email]>
>>>
>>>  clarification:
>>>> are you saying the password notification email is not working
>>>> or
>>>> you would like a different way for it to work.
>>>>
>>>>
>>>> Bruno Busco sent the following on 9/28/2008 12:01 AM:
>>>> > Hi,
>>>> > I am looking into OFBiz for the new customer email verification.
>>>> > What I am looking for is the standard feature that sends to the new
>>>> > customers a confirmation e-mail with a link that must be used to login
>>>> and
>>>> > complete the registration process.
>>>> > In my actual installation I get new customers enabled soon without this
>>>> > check.
>>>> > Is there some way to enable the check?
>>>> >
>>>> > Many thanks,
>>>> > Bruno
>>>> >
>>>>
>>>>
>>>>
>>>
>

[David E Jones]

Bruno,

The closest thing to this in OFBiz that I'm aware of is the contact  
list registration, which does require that you verify an email address  
before the user is fully registered and receives emails through the  
contact list.

Is there a reason you want to do email verification? It's not very  
common in the ecommerce world, mostly because it puts a pretty big  
barrier before a customer can place an order so most companies are  
willing to worry more about payment information and less about contact  
information in order to streamline things.

It's of course not a difficult thing to implement, just not all that  
common (except perhaps in the B2B world where for new customers much  
more than that is reviewed, often with a phone conversation and such  
before any sales against a billing account are allowed).

-David


On Sep 28, 2008, at 1:35 PM, Bruno Busco wrote:

> Jacques,
> for the moment I have done the easy part of your suggestion! ;-)
> *OFBIZ-1977 <https://issues.apache.org/jira/browse/OFBIZ-1977>*
>
> 2008/9/28 Jacques Le Roux <[hidden email]>
>
>> Bruno,
>>
>> I don't think this feature exists in OFBiz OOTB. At least, I'm  
>> quite sure
>> at the UI level.
>> Please, feel free to open a Jira issue and provide a patch.
>>
>> Jacques
>>
>> From: "Bruno Busco" <[hidden email]>
>>
>> Hi BJ,
>>> what is the "password notification email"?
>>> If you mean the "forgot password" feature that let the user have the
>>> password changed and emailed, I am ok with this. The forgot  
>>> password is
>>> correctly working.
>>> What I mean for e-mail verification is the feature that is  
>>> intended to
>>> ensure that the new customer is providing a real e-mail before  
>>> enabling
>>> him
>>> to the access to the site.
>>> I cannot find how to enable this feature. Actually, in my  
>>> installation,
>>> when
>>> a customer registers himself he his directly logged in even if he  
>>> has
>>> input
>>> a wrong e-mail. I would like OFBiz to send him a registration  
>>> confirmation
>>> e-mail with a link that must be used to enable the account.
>>> Not enabled account for a certain amount of time should be deleted.
>>> Is this feature available in OFBiz?
>>> Thank you,
>>> Bruno
>>>
>>>
>>>
>>> 2008/9/28 BJ Freeman <[hidden email]>
>>>
>>> clarification:
>>>> are you saying the password notification email is not working
>>>> or
>>>> you would like a different way for it to work.
>>>>
>>>>
>>>> Bruno Busco sent the following on 9/28/2008 12:01 AM:
>>>>> Hi,
>>>>> I am looking into OFBiz for the new customer email verification.
>>>>> What I am looking for is the standard feature that sends to the  
>>>>> new
>>>>> customers a confirmation e-mail with a link that must be used to  
>>>>> login
>>>> and
>>>>> complete the registration process.
>>>>> In my actual installation I get new customers enabled soon  
>>>>> without this
>>>>> check.
>>>>> Is there some way to enable the check?
>>>>>
>>>>> Many thanks,
>>>>> Bruno
>>>>>
>>>>
>>>>
>>>>
>>>

[Bruno Busco]

David,
thank you for the hint on the contact list, I should have guessed that this
was implemented there because, as you say, this feature is not very common
in the ecommerce world but in the mailing lists. I will start studying that.

The reasons I think this could be useful are mainly two:
1) If we provide an "email lost password" feature we should be sure to have
a valid email address from the very first registration.
2) Since we have no captcha function I am worried about robots that could
generate thousands of false accounts filling up the database. Having neither
captcha and e-mail verification could expose the ecommerce too much, don't
you think so?

-Bruno

2008/9/29 David E Jones <[hidden email]>

>
> Bruno,
>
> The closest thing to this in OFBiz that I'm aware of is the contact list
> registration, which does require that you verify an email address before the
> user is fully registered and receives emails through the contact list.
>
> Is there a reason you want to do email verification? It's not very common
> in the ecommerce world, mostly because it puts a pretty big barrier before a
> customer can place an order so most companies are willing to worry more
> about payment information and less about contact information in order to
> streamline things.
>
> It's of course not a difficult thing to implement, just not all that common
> (except perhaps in the B2B world where for new customers much more than that
> is reviewed, often with a phone conversation and such before any sales
> against a billing account are allowed).
>
> -David
>
>
> On Sep 28, 2008, at 1:35 PM, Bruno Busco wrote:
>
>  Jacques,
>> for the moment I have done the easy part of your suggestion! ;-)
>> *OFBIZ-1977 <https://issues.apache.org/jira/browse/OFBIZ-1977>*
>>
>>
>> 2008/9/28 Jacques Le Roux <[hidden email]>
>>
>>  Bruno,
>>>
>>> I don't think this feature exists in OFBiz OOTB. At least, I'm quite sure
>>> at the UI level.
>>> Please, feel free to open a Jira issue and provide a patch.
>>>
>>> Jacques
>>>
>>> From: "Bruno Busco" <[hidden email]>
>>>
>>> Hi BJ,
>>>
>>>> what is the "password notification email"?
>>>> If you mean the "forgot password" feature that let the user have the
>>>> password changed and emailed, I am ok with this. The forgot password is
>>>> correctly working.
>>>> What I mean for e-mail verification is the feature that is intended to
>>>> ensure that the new customer is providing a real e-mail before enabling
>>>> him
>>>> to the access to the site.
>>>> I cannot find how to enable this feature. Actually, in my installation,
>>>> when
>>>> a customer registers himself he his directly logged in even if he has
>>>> input
>>>> a wrong e-mail. I would like OFBiz to send him a registration
>>>> confirmation
>>>> e-mail with a link that must be used to enable the account.
>>>> Not enabled account for a certain amount of time should be deleted.
>>>> Is this feature available in OFBiz?
>>>> Thank you,
>>>> Bruno
>>>>
>>>>
>>>>
>>>> 2008/9/28 BJ Freeman <[hidden email]>
>>>>
>>>> clarification:
>>>>
>>>>> are you saying the password notification email is not working
>>>>> or
>>>>> you would like a different way for it to work.
>>>>>
>>>>>
>>>>> Bruno Busco sent the following on 9/28/2008 12:01 AM:
>>>>>
>>>>>> Hi,
>>>>>> I am looking into OFBiz for the new customer email verification.
>>>>>> What I am looking for is the standard feature that sends to the new
>>>>>> customers a confirmation e-mail with a link that must be used to login
>>>>>>
>>>>> and
>>>>>
>>>>>> complete the registration process.
>>>>>> In my actual installation I get new customers enabled soon without
>>>>>> this
>>>>>> check.
>>>>>> Is there some way to enable the check?
>>>>>>
>>>>>> Many thanks,
>>>>>> Bruno
>>>>>>
>>>>>>
>>>>>
>>>>>
>>>>>
>>>>
>

[David E Jones]

On Sep 28, 2008, at 11:17 PM, Bruno Busco wrote:

> 2) Since we have no captcha function I am worried about robots that  
> could
> generate thousands of false accounts filling up the database. Having  
> neither
> captcha and e-mail verification could expose the ecommerce too much,  
> don't
> you think so?

What is the worst case scenario for these? Extra registrations?

There are many forms of denial-of-service attacks, I must admit I've  
never heard of one that specifically targets automated account  
creation on ecommerce sites. Usually automated account creation is  
used for sites where public postings can be made, like free email and  
public forums and such.

Whatever the case, it's really not my decision unless I'm running an  
ecommerce company myself. That's something I'd generally leave up to a  
client to decide on. If someone did ask my opinion, I'd say the  
inconvenience to a customer (and corresponding abandoned carts) may  
not be worth it. Of course, it should also be considered that adding  
captcha and/or email verification may not have any effect on customer  
conversion rates and what what. If a company really wanted to know  
either way the best approach would be to do random testing of using  
and not using each across a large customer base.

-David

[BJ Freeman]

The only attraction on most robots, from my experience with store
owners, is if there is a forum or blog associated with the ecommerce
site. This is usually used to increase rankings for SEO.
The main thing that Ecommerce faces is Fraud orders, where a person will
flood a site with bogus orders. neither captcha or authentication will
do anything to keep this from happening. IP addresses and countries are
usually enough to spot such bogus orders.
Also note that a lot of People don't want any information outside their
address to be delivered to, so they will put in a bogus email address.
The email verification will save a bounced emails when the notification
emails are sent. On the other hand once a bounce email is returned .
that my be, depending on the bounce, a way to verify the email address.

David E Jones sent the following on 9/29/2008 10:01 PM:

>
> On Sep 28, 2008, at 11:17 PM, Bruno Busco wrote:
>
>> 2) Since we have no captcha function I am worried about robots that could
>> generate thousands of false accounts filling up the database. Having
>> neither
>> captcha and e-mail verification could expose the ecommerce too much,
>> don't
>> you think so?
>
> What is the worst case scenario for these? Extra registrations?
>
> There are many forms of denial-of-service attacks, I must admit I've
> never heard of one that specifically targets automated account creation
> on ecommerce sites. Usually automated account creation is used for sites
> where public postings can be made, like free email and public forums and
> such.
>
> Whatever the case, it's really not my decision unless I'm running an
> ecommerce company myself. That's something I'd generally leave up to a
> client to decide on. If someone did ask my opinion, I'd say the
> inconvenience to a customer (and corresponding abandoned carts) may not
> be worth it. Of course, it should also be considered that adding captcha
> and/or email verification may not have any effect on customer conversion
> rates and what what. If a company really wanted to know either way the
> best approach would be to do random testing of using and not using each
> across a large customer base.
>
> -David
>
>
>
>

[Bruno Busco]

Many thanks to you both for sharing your experience of the ecommerce world.

What you say makes a great sense and makes me more confortable with having
(or making someone have) an ecommerce site without captcha and e-mail
verification.

When I will have some time I would anyway try to have an email verification
feature that could be enabled/disabled following David's hint about the
contact list.

-Bruno

2008/9/30 BJ Freeman <[hidden email]>

> The only attraction on most robots, from my experience with store
> owners, is if there is a forum or blog associated with the ecommerce
> site. This is usually used to increase rankings for SEO.
> The main thing that Ecommerce faces is Fraud orders, where a person will
> flood a site with bogus orders. neither captcha or authentication will
> do anything to keep this from happening. IP addresses and countries are
> usually enough to spot such bogus orders.
> Also note that a lot of People don't want any information outside their
> address to be delivered to, so they will put in a bogus email address.
> The email verification will save a bounced emails when the notification
> emails are sent. On the other hand once a bounce email is returned .
> that my be, depending on the bounce, a way to verify the email address.
>
> David E Jones sent the following on 9/29/2008 10:01 PM:
> >
> > On Sep 28, 2008, at 11:17 PM, Bruno Busco wrote:
> >
> >> 2) Since we have no captcha function I am worried about robots that
> could
> >> generate thousands of false accounts filling up the database. Having
> >> neither
> >> captcha and e-mail verification could expose the ecommerce too much,
> >> don't
> >> you think so?
> >
> > What is the worst case scenario for these? Extra registrations?
> >
> > There are many forms of denial-of-service attacks, I must admit I've
> > never heard of one that specifically targets automated account creation
> > on ecommerce sites. Usually automated account creation is used for sites
> > where public postings can be made, like free email and public forums and
> > such.
> >
> > Whatever the case, it's really not my decision unless I'm running an
> > ecommerce company myself. That's something I'd generally leave up to a
> > client to decide on. If someone did ask my opinion, I'd say the
> > inconvenience to a customer (and corresponding abandoned carts) may not
> > be worth it. Of course, it should also be considered that adding captcha
> > and/or email verification may not have any effect on customer conversion
> > rates and what what. If a company really wanted to know either way the
> > best approach would be to do random testing of using and not using each
> > across a large customer base.
> >
> > -David
> >
> >
> >
> >
>
>