Why is there no account creation verification in Zen?

Ive just realised that when someone creates an account their is no email verification code, etc sent to the customer.

I see the downsides of not doing this as:

• anyone can create an account using false details
• you are vulnerable to attacks by hackers or rivals creating a lot of accounts quickly (automated) which could bring your site to its Knees (DOS) plus a big cleanup

I don't want to have to manually authorise accounts for people trying to create logins to purchase stuff after hours.

As a minimum I need:

• customer is not automatically logged in after creating account
• customer can not log in until they have responded in some way to an email they have been sent

The above two features are implemented by many online sites - so I assume it can be done with Zen Cart as well?

I've just realised that when someone creates an account there is no email verification code, etc sent to the customer.

This seems like a gaping security oversight to me.

I see the downsides of not doing this as:

* anyone can create an account using false details and then use this for all sorts of undesireable activitiy.
* It makes the site vulnerable to attacks by hackers or rivals creating a lot of accounts quickly (automated) which could bring your site to its Knees (DOS) plus a big cleanup

I don't want to have to manually authorise accounts for people trying to create logins to purchase stuff after hours.

As a minimum I need:

* customer is not automatically logged in after creating account
* customer can not log in until they have responded in some way to an email they have been sent

The above two features are implemented by many online sites - so why not with Zen cart.

Does anyone know of a solution to this problem?

The above two features are implemented by many online sites - so I assume it can be done with Zen Cart as well?

Sure, but not online SHOPPING sites. Anything that stands in the way of making the sale will dramatically reduce your conversions.

Kim:

Sure, but not online SHOPPING sites. Anything that stands in the way of making the sale will dramatically reduce your conversions.

It seems that Zen Cart is so flexible it can cater to nearly every whim and desire with a little fiddling.

What's to stop someone setting up a fictious account and buying something with a stolen credit card and listing the shipping details as a different address from the card holder?

What am I missing here?

And what stops an automated DOS attack on the login page?

I think you are making a mountain out of a mole hill. Can you provide examples / articles of any other eCommerce software that has experienced the situations you described.

Also, a DoS attack is better stopped through Server and/or Data Center security protocols than any script could do.

Liamv:

It seems that Zen Cart is so flexible it can cater to nearly every whim and desire with a little fiddling.

What's to stop someone setting up a fictious account and buying something with a stolen credit card and listing the shipping details as a different address from the card holder?

What's to stop someone doing the exact same thing using a throwaway Hotmail account, which will be dutifully 'verified' ?

If you think MS is going to bend over backwards trying to find the person who set up that account, you've obviously never had to report CC fraud. No entity in the ecommerce business, save the merchant who usually gets stuck with the loss, takes it seriously.

We all run certain risks selling stuff online. If you have some real way of reducing ththose risks, I'm all ears. This isn't it.

Liamv:

What's to stop someone setting up a fictious account and buying something with a stolen credit card and listing the shipping details as a different address from the card holder?If somebody had gotten hold of a stolen credit card then a double opt-in on the email address isn't going to get in their way at all. They'd probably already have a hotmail (or similar account) set up via a proxy server through which to co-ordinate their purchasing anyway.

Liamv:

And what stops an automated DOS attack on the login page?Again, not a double opt-in on the email address. DOS attacks target a site rather than a specific page. Concentrating one on the login page would be inefficient as it not a high load page, so you'd need more bots in your network to bring the site down.

But as you say ...

Liamv:

It seems that Zen Cart is so flexible it can cater to nearly every whim and desire with a little fiddling.Since Zen Cart is open source, if your site particularly needs these features, you can add them. Though I suspect you'll achieve you objective not through the features themselves, but rather because they'll throttle the growth of your site and thus keep it below the hackers' and fraudsters' radar.

kim:

sure, but not online shopping sites. Anything that stands in the way of making the sale will dramatically reduce your conversions.

qft!!!!

So Liam,

You go to the mall, start to go into a store to shop for the lovely items you see in their window.

The clerk says, "Hold on there Mate!" "Let's have your home address and we'll mail you a pass to shop." "That way, when you come back later this week, you can shop to your heart's content."

Do you think you or anyone else would return?

Zen Cart flags an order the does not have the same billing and shipping address. My time spent is valuable, but spending time checking the mismatches is well worth what I would have to spend to get a customer to "come back to the mall."