Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Correct Way to Validate Email Addresses

hackernoon.com

Post reply on HN
Print view View original

81–90 of 405 posts

Re: The Correct Way to Validate Email Addresses

#81

Post by mayneack »

parennoob wrote: post #64
Benjamin_Dobell wrote: post #30

The number of websites that try reject my email address with a + in it, ugh! Surprisingly, the validation is often done 100% client-side anyway, and simply modifying the incorrect regex lets my email address through... If I wrecked havoc on your back-end, then it's your fault for sucking ;)

Can you name some popular websites that do this? Speaking as someone who uses + addresses to filter stuff from mostly well-known websites, I have never seen this. I have seen this a few times on old, crusty, finance websites etc. but I hardly ever need to use a + address with them anyway. (It does make me wonder about how good their internal security is, though.)

BestBuy allowed me to sign up with a trailing "+bestbuy@gmail.com", but their unsubscribe interface rejects it as invalid, so I can't unsubscribe from their promos. I just filter/mark as spam and move on.

Re: The Correct Way to Validate Email Addresses

#82

Post by namenotrequired »

stouset wrote: post #39
gizmodo59 wrote: post #21

Earlier quoted context omitted.

Asking to retype though being a simple solution IMHO is asking for a lot. Consider a user who uses mobile phone, even copy paste is annoying. Validating if the mail box exists and that it does not belong to a provider like mailinator and then sending a confirmation link to them works. While its not perfect, it does address lot of other concerns without sacrificing user experience.

Also, asking to retype makes sense for a password where you can't visually verify that you typed what you expected. For an email address, it's pointless and frustrating. Send an email. If it bounces or doesn't get verified in a timely fashion, it was a mistake and delete the account.

And the user never discovers their mistake.

Re: The Correct Way to Validate Email Addresses

#83

Post by [deleted] »

pwg wrote: post #55
usaphp wrote: post #48

Earlier quoted context omitted.

Or when a password that is generated by my password manager is rejected with a message "Password should be 12 characters maximum". Why???

This very heavily implies that the database column which stores "passwords" is typed as "char(12)" and that the site is storing unhashed plaintext passwords in that column. Why: Because if they were (at least) hashing the password, then the output of the hash would be a fixed size token unrelated to the length of the input plaintext password, and no such arbitrary short limit would be necessary on the plaintext passw…

[deleted]

Re: The Correct Way to Validate Email Addresses

#84

Post by GirlsCanCode »

Ameo wrote: post #40

I have a .link domain for my personal email and a lot of sites refuse to let me register because they don't recognize it as a valid TLD. Then there's the textbook company that lets me register but refuses to let me reset my password claiming that I'm trying to enter an "invalid email address."

I had a .to domain for a while, and I had an email address "firstname@firstname.to" where firstname is my first name. I wanted to use it when I needed to give out emails causally, like if someone from Church or some other group wanted my email.

I gave up on it, not because of computer validation but because of stupid people! Nobody would "get" the .to domain and they'd always think there should be a .com or .gmail.com on the end of it. Especially older people.

So I gave it up.

Re: The Correct Way to Validate Email Addresses

#85

Post by robbiemitchell »

tedmiston wrote: post #33
acdha wrote: post #25

Earlier quoted context omitted.

You can use a regex as a simple pre-check but you absolutely have to do more than that if you expect high-quality results. Back in the 90s, we ran the customer rewards program mailing list for a mainstream business you've heard of. A [gnarly] regex took care of the gross failures but we still had double-digit percentage of invalid addresses and many spam reports because people mistyped their username, used their old…

Definitely, I think email validation links are important too. However, it's pretty senseless to let an obviously invalid email address pass all the way through to that layer (and potentially get billed for sending messages to invalid email addresses).

The marketing or product team might prefer the "cost"(?) of sending a bad email here and there to the cost of losing a customer because the email is incorrectly rejected.

Re: The Correct Way to Validate Email Addresses

#86

Post by kevin_thibedeau »

JshWright wrote: post #36
maxerickson wrote: post #16

Yes, please do send activation emails (or perhaps a personal confirmation email if you are establishing contact with someone that wrote down an address for you). Those of us with firstnamelastname@commonhost will appreciate not getting bills and job offers and such.

I've been getting monthly status reports from some guy's Hyundai for months... The unsubscribe link does nothing... I'm tempted to reset his password and change the email address.

Password resets are the only solution. I did that years ago when someone signed up for a Facebook account with my address and I kept getting friend notifications. I let it go for a few years and Facebook was happy to keep an unvalidated account active the whole time.

Re: The Correct Way to Validate Email Addresses

#88

Post by ceejayoz »

blechschmidt wrote: post #53
Benjamin_Dobell wrote: post #30

The number of websites that try reject my email address with a + in it, ugh! Surprisingly, the validation is often done 100% client-side anyway, and simply modifying the incorrect regex lets my email address through... If I wrecked havoc on your back-end, then it's your fault for sucking ;)

Yes, the + is incredibly useful for tagging emails. When I register new web accounts, I always specify a new unique tag so that I can track down the source in case I receive spam. Furthermore, they help my mail server when filtering out junk mail.

A lot of spammers will rip out the + tagging on a Gmail account. Probably works better if you have a domain in front of it via Google Apps.

Re: The Correct Way to Validate Email Addresses

#89

Post by oddlyaromatic »

mook wrote: post #67
cperciva wrote: post #34

Earlier quoted context omitted.

Worse than that: I've encountered a few web sites which accept email addresses with '+' characters... and then tell me that my email address has a ' ' character in it. Every time I see this I think "there's got to be a multiple-form-decoding vulnerability here"...

I've got an account where they just plain stripped the + character. Since I happen to have used only alphanumeric charters after, I am now registered with an email address I can't actually receive mail on - it goes to somebody else's inbox. Account synchronization was involved - IIRC the initial address confirmation message got thorough.

I thought that though the + is valid, nothing after the + is used to differentiate the email address? I use local+Organization when I sign up for an email list so that I can easily filter, plus I can see if that email address gets shared around. So on places that reject the + I just use everything before it as the local part. Maybe I'm missing something. Edit: I guess not all email providers do it this way but here's a link to more info: https://www.cs.rutgers.edu/~watrous/plus-signs-in-email-addr...

Re: The Correct Way to Validate Email Addresses

#90

Post by [deleted] »

zAy0LfpBZLC8mAC wrote: post #51
jwecker wrote: post #13

I always assumed it was more a sanitization issue for security's sake. By allowing only a simple subset ("common") email address type, you can be ambivalent about what email server is running and how it reacts to the wide variety of specially crafted email addresses. With no validation other than sending the email, you have to know, for example, what the server would do with an email address that claims to be @localh…

> I always assumed it was more a sanitization issue for security's sake. Sanitization is at best idiotic, at worst creates security problems. There is no such thing as "bad characters", there only is broken code that incorrectly encodes stuff. If you ever find yourself modifying user input "for security reasons" (or really, for any reason at all), you are doing it wrong. The only sane thing to do is to make sure that…

[deleted]
Post reply on HN