141–150 of 405 posts
It does seem effective to have someone type the address twice as that can catch a typo fairly easily.
No. Absolutely beginner level blog post. You would use a third party tool like http://www.datavalidation.com/ or mailgun's email validation service or BriteVerify etc etc. There are a ton of validation services now. We are living in a time when trillions of email addresses have been tried, entered and deployed to. So why reinvent the wheel on your website? 3rd party services are based not only on parsing the string b…
This means, no email validation, no address verification emails, heck, I don't even have a password confirmation field. One field for name, one for email and one for password and you are in.
If 10% of the users don't trust me with their real, or even throwaway email address, so be it. My goal is not to collect email addresses, but to have users use my application and add some value to their life.
If another 10% of them enter a mistyped email, they will figure it out eventually and change it if they care.
I do a lot of optin email. Here are some examples of bounced emails that people use to sign up: * somename@gmail.co * anothername@yhoo.com * myemail@hotmial.com These are very common errors that occur nearly every day. A regex isn't going to help here. What does help, is a notification that asks people to verify what they typed –– if the email contains an obvious, common error, such as one listed above.
No. Absolutely beginner level blog post. You would use a third party tool like http://www.datavalidation.com/ or mailgun's email validation service or BriteVerify etc etc. There are a ton of validation services now. We are living in a time when trillions of email addresses have been tried, entered and deployed to. So why reinvent the wheel on your website? 3rd party services are based not only on parsing the string b…
My philosophy is exactly the opposite. Allow anything as email address and make it as simple as possible for the user to sign up to use my application. This means, no email validation, no address verification emails, heck, I don't even have a password confirmation field. One field for name, one for email and one for password and you are in. If 10% of the users don't trust me with their real, or even throwaway email a…
The number of websites that try reject my email address with a + in it, ugh! Surprisingly, the validation is often done 100% client-side anyway, and simply modifying the incorrect regex lets my email address through... If I wrecked havoc on your back-end, then it's your fault for sucking ;)
Even worse is rejecting my password because it has a + in it! Why do you as a business care what my random password generator spit out?? Scarier still is when it's a server-side response that rejects my password for its contents...
Terrible security, sure, but at least it came from the desire for usability, not just basic encryption idiocy.
No. Absolutely beginner level blog post. You would use a third party tool like http://www.datavalidation.com/ or mailgun's email validation service or BriteVerify etc etc. There are a ton of validation services now. We are living in a time when trillions of email addresses have been tried, entered and deployed to. So why reinvent the wheel on your website? 3rd party services are based not only on parsing the string b…
/s? I seriously can't tell.
Earlier quoted context omitted.
Even worse is rejecting my password because it has a + in it! Why do you as a business care what my random password generator spit out?? Scarier still is when it's a server-side response that rejects my password for its contents...
An extremely large company I was involved in building a system for had a requirement that you be able to read your password over the phone to a call center agent, resulting in requirements like case insensitivity and character limits. Terrible security, sure, but at least it came from the desire for usability, not just basic encryption idiocy.
The text of the password should not persist.
Correct way is run a regex for [wildcard @ wildcard . Wildcard] then send an opt-in email real-time as the user is typing additional info. If it bounces before the user finished the onboard form - alert them to the issue. If it gets validate, autologin the user. If bounces or there's zero response by the time the user completes the form, alert them, ask to type their email again without access to the reprior entry -…
Earlier quoted context omitted.
An extremely large company I was involved in building a system for had a requirement that you be able to read your password over the phone to a call center agent, resulting in requirements like case insensitivity and character limits. Terrible security, sure, but at least it came from the desire for usability, not just basic encryption idiocy.
No, the system isn't secure. The text of the password should not persist.
Earlier quoted context omitted.
Even worse is rejecting my password because it has a + in it! Why do you as a business care what my random password generator spit out?? Scarier still is when it's a server-side response that rejects my password for its contents...
> Scarier still is when it's a server-side response that rejects my password for its contents... A friend's project decided to disallow umlauts, combined characters like ´e (can't type the correct e with accent mark), the pipe symbol and a couple more in new passwords. Not due to plaintext storage or so, but because of customer service issues - people were bugging support all the time because they were e.g. abroad an…
Looking forward? That happened a year ago and caused problems because the OS X Yosemite login screen had no way to input emoji:
http://apple.stackexchange.com/questions/202143/i-included-e...