Why do I need to validate my email when I ask for email notifications, when I am signed with Google sign-on/Facebook etc?

I put it as a bug, as I think un-needed user operations are bugs (But I guess others will think otherwise).


This is needed in the general case. It's trivial for anyone to set up an OpenID provider that claims any email address at all. If it weren't done you could sign bill@microsoft.com up for updates with no validation - clearly an undesirable feature.

Email subscription is a one off operation - the validation doesn't hurt it much and special casing specific providers isn't great either.

  • 1
    There is also buggy implementation of OpenID that allows the use of email of any valid account under the domain. – nhahtdh Aug 2 '12 at 14:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .