title: Security for Email verification/confirmation
body: <p>When someone registers on a website with their Email addresses, usually they are asked to verify or confirm their email by clicking on a link in a email address that they are sent to. Same goes for subscribing or unsubscribing to a mailing list.</p>
  
  <p>Usability wise, this is great. It's very quick and easy to do, I can't think of anything that beats it.</p>
  
  <p>I am not sure if I am overthinking things, but I just wanted see if I missed anything or misjudge anything.</p>
  
  <p>So as far as I know the <strong>purpose</strong> of email verification/confirmation is </p>
  
  <ul>
  <li>To make sure that the email address is correct</li>
  <li>To make sure Emails that are sent to this address can be read and received</li>
  <li>To make sure the email address really belongs to the person who's trying to sign up</li>
  </ul>
  
  <p>With the current popular implementation of just one link that they click and that verifies the email instantly, someone could just brute force the verification link and circumvent this whole step. </p>
  
  <p>Just visit <code>verify.php?code=YOURBESTGUESSHERE</code> and try all kinds of different codes.</p>
  
  <p>An attacker could now make the following <strong>exploitations</strong>:</p>
  
  <ul>
  <li>hurt my business by unsubscribing a bunch of people from my mailing list</li>
  <li>add a bunch of people to my mailing list without their consent, since they might not be interested in my content, they could think I'm spam and a bad business</li>
  <li>someone could farm addresses by checking the responses on the verification page (for example if the response is "mail@server.com is already verified" or so)</li>
  <li>someone could create fake accounts without the need of having an actual working email address </li>
  </ul>
  
  <p>I am not sure what the benefit of the latter would be, and it seems it would be much easier to just create a throw away address for this purpose, but I just wanted to put it up there to be complete.</p>
  
  <p>My Questions:</p>
  
  <ul>
  <li>Did I miss any other <strong>purposes or exploitations</strong> of email verification / confirmation?</li>
  <li>Should I add layers of security to the email verification, such as a captcha or time delays to prevent brute forcing?</li>
  <li>Should I ask for additional information other than the reset code? Like username or email address again? Or a security question type thing, or another piece of information they entered when registering?</li>
  </ul>
  
  <p><strong>What are best practices for this whole thing, and how much worry and effort does really need to be put towards it? Risks vs. Benefits / Security vs. Usability... ?</strong></p>