131–140 of 228 posts
I wrote a short (but incomplete) research comparing mail servers (MTAs) and their handling of local-part in my ongoing effort to reduce spam and to tackle who is leaking my email address.
‘Local-part’ is the part of the email that is between your account name and the ‘@‘ symbol. For some MTAs, it CAN be the part before your account name.
https://egbert.net/blog/articles/comparison-of-local-part-in...
Earlier quoted context omitted.
The most underrated crypto thing that people don't discuss enough, is that i don't need an email account to interact with web3 apps, i just sign in with metamask. if I could do it for every single app around that would be great.
If only browsers had a public/private keychain built in to sign and encrypt messages. Authenticating = sign a message with your private key.
Nobody is accepting random self-signed certificates, of course, usually they need to be signed by a CA belonging to the party you're authenticating to, but there's no technical reason why you can't use a random certificate to authenticate with a website, or even modify your browser to add a quick and easy button to generate them on the fly.
Browser vendors have stopped caring about this type of auth and are focusing more on webauthn, which stores a cryptographic token in your device's secure storage (if available) or on the file system. When browsing from a phone, this means it's essentially "sign in with your fingerprint" for websites, which is really cool! You can't easily back those tokens up, though, so you still need something like a recovery email if you don't want your users to lose their accounts when they drop their phones too hard.
Can't upvote this enough. There simply is no need to check the email addr provided by the user. Send the mail, if it bounces, the user has only himself to blame. What if I don't want them to go through the hassle of an activation link? Then I don't bother with an email account in the sign-up process in the first place. If they want a passwd reset method, they can later provide an email in their settings page, if that…
The most underrated crypto thing that people don't discuss enough, is that i don't need an email account to interact with web3 apps, i just sign in with metamask. if I could do it for every single app around that would be great.
Can't upvote this enough. There simply is no need to check the email addr provided by the user. Send the mail, if it bounces, the user has only himself to blame. What if I don't want them to go through the hassle of an activation link? Then I don't bother with an email account in the sign-up process in the first place. If they want a passwd reset method, they can later provide an email in their settings page, if that…
The most underrated crypto thing that people don't discuss enough, is that i don't need an email account to interact with web3 apps, i just sign in with metamask. if I could do it for every single app around that would be great.
If there was a way for end users to sync webauthn logins, we'd solve this problem without ever resorting to any kind of blockchain whatsoever.
1) simple regex to rule out the common typos such as 2 or 0 @, no period in the domain name, etc. I don't care about people whose domain name consists of a TLD only. Bring your nerdiness somewhere else, every other service is already rejecting your exotic e-mail address already anyway. Same for spaces in the local part of the address, etc. 2) if second level domain not in list of famous second level domains, AND leve…
I’ve never understood this, but heard it often from developers and product owners in the industry. “I don’t care about the small number of users who X” where accommodating X is essentially free. Or worse: deliberately taking the eng time to reject users X where accepting takes no work!
Especially in a business context where users X are trying to hand the business money.
I had a tech lead once who say we should reject non-ASCII characters in user input “because they are an edge case.” Nothing in the rest of the data flow or database storage required ASCII characters and it took eng effort to filter them out. Boggles the mind sometimes.
Does anyone on HN have any of these "surprising" email addresses that most people and developers do not expect? How does it work with common e-mail clients? How do people react when you show/tell them your email? I have a domain that uses non-ascii characters, and while I can receive emails on that domain, hosted by Fastmail, Fastmail clients refuses to _send_ emails to that domain (I can, if I type the domain as Pun…
I have my own domain and a catch-all setup, so when I sign up for a service, it's the-service-name@my-domain-name.com, if I give someone my email address, it's their-name@my-domain-name.com It makes it easy for me to keep track of who is sending me what + who is sharing my email with third parties, but definitely confuses some people.
That being said, you need to be very careful with what regex validation you are doing. I still use an apple "@me.com" email. Somewhere there is a commonly used library (or commonly used regex copied from stack overflow) that seems to fail because my domain is short. I have had a number of times that I have been unable to get emails because a system flagged it as invalid.
Getting through to support or trying to change my email is always a nightmare in these situations.
So be careful with your assumptions!
RFCs for email addresses are cool, but on the web we have our own standards! https://html.spec.whatwg.org/multipage/input.html#valid-e-ma... "This requirement is a willful violation of RFC 5322, which defines a syntax for email addresses that is simultaneously too strict (before the "@" character), too vague (after the "@" character), and too lax (allowing comments, whitespace characters, and quoted strings in manner…
If you really want to take validation seriously, why not add a human element to it, and not design one line of code to try to fix everything? One of the biggest problems with email input is typos -- and there are some very common typos that could easily be accounted for with code. For example foo@gmail.co, foo@gmial.com, foo@comcast, etc. It should be common, when these types of typos occur, to prompt the user to fix…
Does anyone on HN have any of these "surprising" email addresses that most people and developers do not expect? How does it work with common e-mail clients? How do people react when you show/tell them your email? I have a domain that uses non-ascii characters, and while I can receive emails on that domain, hosted by Fastmail, Fastmail clients refuses to _send_ emails to that domain (I can, if I type the domain as Pun…
I can't type one of my email address on HN as it has emojis in the hostname. It works great with Fastmail. It gets problematic when I use emojis in the mailbox name as well. At lot of hosts won't allow that. You can see the email address on the front page if I paste the punycode web address on here: https://xn--bp8hgh.to/
While emoji aren't a use case you'll get many managers to care about, there are plenty of unicode characters that can. Email addresses using foreign script, for one, or even just characters like åäáà, not uncommon in European names, might convince people to consider enabling such features.
Sadly, the process of enabling support for such characters is much harder than it should and I've got to admit they my mail infrastructure also can't handle these types of email addresses. Modern MS Exchange servers seem to have finally implemented support, though, so perhaps we may see more support for it in the future!
I think an initial test with regex is valid. But you should do a proper email validation link. That being said, you need to be very careful with what regex validation you are doing. I still use an apple "@me.com" email. Somewhere there is a commonly used library (or commonly used regex copied from stack overflow) that seems to fail because my domain is short. I have had a number of times that I have been unable to ge…
I have found two ways of getting around this issue.
1) Continue registration for a new site using a temporary email. Once logged in, I find I am often allowed to change the email to whatever I want within my user settings. 2) Contact support and request they updated it for me manually.
These two work arounds don't always work. But more often than not they do.