Discuss: Support multiple secondary emails

[shane-tomlinson]

This is a request from the Monitor team. Monitor is integrating FxA and is going to pre-populate the user's email list on Monitor by fetching the email addresses associated with the user's FxA account. The thing is, many Monitor users have more than 2 emails (myself included). It'd be great if we allowed users to associate all of their email addresses with their FxA account.

The FxA limit of 1 secondary email is a front-end limitation, the backend already supports more than 1 per account.

cc @groovecoder

┆Issue is synchronized with this Jira Task
┆Issue Number: FXA-727

[rfk]

It's also worth noting that each email address can only belong to one account. This makes sense from an account-system perspective, but it's caused some confusion for users in the past so I wanted to call it out explicitly. (For example, you might imagine a Monitor user wanting to add a shared family email address to their account in order to monitor it, but they can't because it's already on another user's account).

[vladikoff]

This is a request from the Monitor team. Monitor is integrating FxA and is going to pre-populate the user's email list on Monitor by fetching the email addresses associated with the user's FxA account.

This feels uneasy. From engineering and product point of view it seems a lot easier to just track multiple emails on the Monitor side. This way you get metrics, better UX and more flexibility to do whatever you want. I don't think FxA benefits from this, does it even make the account less secure this way? The more emails you add and verify, etc. We made a decision to stick with 1 email until we really needed to switch and I don't think this tips the balance.

[shane-tomlinson]

We made a decision to stick with 1 email until we really needed to switch and I don't think this tips the balance.

Is there a link to a feature doc, discussion or rationale behind the choice? I'd like to find out more.

[shane-tomlinson]

does it even make the account less secure this way?

Can you explain? It's only possible to sign in with the primary email, the number of secondary emails shouldn't change that. Is there a way to use a secondary email address to bootstrap a verified session? Notifications to more than one secondary address could be spammy, though we could either create a policy or allow users to select addresses at which they want to receive notifications.

[groovecoder]

From engineering and product point of view it seems a lot easier to just track multiple emails on the Monitor side. This way you get metrics, better UX and more flexibility to do whatever you want.

Engineering-wise, yes it's easy on the Monitor side right now. But we're planning to integrate with FxA deeply, and want deliver some non-Firefox/non-sync account services with Monitor. So we're asking for a bit of re-thinking around the higher-level scope of FxA here. I personally like the idea of my Firefox Account (with Monitor) being my online account that keeps all my other online accounts safe & private.

Since so many of peoples' online accounts revolve around email addresses, it seems natural to use them as the mechanism to identify (and then service) peoples' online accounts. And we'd like to be able to give people a compelling value-prop (i.e., Monitor) that makes sense for them to add more email address to their FxA.

[sandysage]

We're going to test this on the Monitor side and share our findings. Thanks all for the discussion. I'm going to suggest this issue can be closed.

[vbudhram]

@sandysage Feel free to reopen after findings.

[vladikoff]

Thank you @sandysage !