分析这种用户注册方法

Question

Consider the following approach regarting an user registration system:

1. The user fills out a form and send.

2. The system sends an email confirmation to the user and the confirmation link contains all user data (obfuscated).

    http://mysite.com/register?name=John&mail=john@john.com&pass=123&etc (obfucated, say, base16). 

3. No registration is actually performed in the system yet.

4. The user clicks the link.
5. The system then finally register the user using the link data.

What are the failures of that approach? Especially in terms of security.

I thought this approach in order to avoid the junk columns (such as "activated") in the database. Such things.

Answer 1

To start, the password should never be passed around. As soon as your site collects it, it should be salted, hashed, and stored in the database never to leave again. It definitely shouldn't be emailed or passed in a query string, and for all intents and purposes, encoding is no better than clear text.

Second, sensitive data in the querystring should be avoided in general. From a security standpoint, you would generate a crypto-secure random token with a short expiration to be sent in the email and use that to identify the user when they return to activate.

I would suggest sticking to the tried and true registration approaches, and just dealing with the extra tables and columns. Generally speaking, when it comes to security, rolling your own solution is a bad idea (A rule of thumb that I abide by, and I think just about everyone else should too).