TYPO3 Core

Hi Torben,

Thanks, for your reply!

In the real life are numerous scenarios where multiple accounts with one mail address are meaningful,

I will give you to:

1. You have a family, Mum, Dad, Son and Daughter, using one family Mail-Adress like the.flintstones@aol.com. Which also undermine your Security Argument to some extent.

2. You have a Service-Portal e.g. an B2B Portal with different Accounts and Subjects like Company1 and Company2 witch needs to be for security and regulatory reasons separate. It happens right often that the same persons with the same E-mail is responsible for two accounts like Bookkeeper, Business Owner with more than one Company, Freelancer a.s.o.

Long story short, we do have many cases and projects where the same mail is used and this in a reasonable use and not in an edge cases scenario.

If we support accounts with the same E-Mail what we should do, we need a proper password reset process. I can compromise that the password reset will be then done via the username.

Btw, E-Mail use in private array is more than dead!
In business, it will be probably the same, so we should think about more modern Concepts for Authentication and Password recovery, but this is another topic.

Your examples do not really convince me. Think of a website with a forum. For your first scenario, son could reset daughters password and write a personal message to mum saying something bad. Daughter can not prove it was not her who wrote the message. This is a general problem with sharing accounts or email addresses.

The TYPO3 backend login does also not consider this scenario and rejects to send a password recovery email, if multiple backend accounts with the same email address exist.

So I would still not support this core-wise and would opt for streamlining the password recovery feature for ext:felogin with how the TYPO3 backend handles it (send no email, if multiple accounts with the same email exist and show a message instead).

A new PSR-14 event could be added, where developers can implement a process that fulfills project requirements.

So if a family has the problem you described, they have a profound trust problem that we cannot solve technically and should be solved through social work. By the way, I am also talking about children younger than 6 years, where the guardians decide not to create email addresses for the children, which I respect.

Your proposal is good because the standard will be: one account one email address. As far we can customize it via an event, it is fine for me.

BTW: in TYPO3 11 the reset with multiple Emails is broken, see issue: 99902