That whole article could have have been two sentences. Also the problem with it is obvious: not all users have a email client configured. Back in 98 I used to get confused when I clicked an email link and windows would spend ages trying to open up some program called Outlook up!
Why don’t we do email verification in reverse?
61–70 of 329 posts
Re: Why don’t we do email verification in reverse?
#62Earlier quoted context omitted.
Yes. 1) DKIM, SPF and DMARC do not prevent spoofing, they simply make it less easy. A compromise of those methods, or an attack on DNS or BGP, or any other novel spoofing attack, gives the attacker a successful attack vector that would not exist if the website simply sent the user an email to verify. 2) The unique token and timeout is simply given to the attacker when the attacker initiates the new account/password r…
> or an attack on DNS or BGP, or any other novel spoofing attack Even though it’s be relevant form as systems-thinking point of view, it’s pretty unfair to dismiss a solution because it will be vulnerable to very important pieces of Internet network infrastructure. I think it’s safe to say that if we get a sufficiently bad vulnerability in DNS or BGP, account confirmation emails are going to be least of our worries.…
It's not unfair to point out a design as needlessly insecure. Regardless of the method, this design adds a new attack vector (email spoofing) that did not exist before. Even if it was very hard to do, it's an unnecessary added risk.
Re: Why don’t we do email verification in reverse?
#63Earlier quoted context omitted.
I'd argue the crux is about proving that Me The Service can send You The User whatever info is needed (password reset, notification of planned downtimes, pricing changes, warnings about service abuse) to this address - and you'll get it. I don't care about you "controlling" an email address - you can easily get fake ones for free. It's about both parties having agreed _at least once_ on a way for the service to commu…
Ownership over the email shortname is exactly what is being proven. It’s your identity as far as the service is concerned. I can block emails from a service right after verifying so verifying does not guarantee that I will receive emails from the service at any point in the future.
If you do block it, your access to the account you’ve created might be in jeopardy. At least it depends on how you “block” it. If the service receives an error on future emails, the user’s account can be disabled, as usually described in the TOS.
Re: Why don’t we do email verification in reverse?
#64I've had situations where some email clients (including Outlook) would visit URLs in emails, for "link protection" purposes. Coupled with the magic-link approach (including a token in the URL that authenticates the user), this can cause a lot of problems.
Apple Mail does this by default now too.
Re: Why don’t we do email verification in reverse?
#65And hope there is a human for anything that doesn’t match. People will remember that email and use that to contact support.
Re: Why don’t we do email verification in reverse?
#66The obvious reason might be that email verification might be done on a different device.
Re: Why don’t we do email verification in reverse?
#67I would hate this, and probably instantly bail out of any flow that tried to force it on me. Being able to receive mail on an address should not necessarily imply a capability to send from it. This scheme rules out many actual or potential schemes for email anonymity, especially in a world where very little email is still transactional relatively speaking. I do not give (almost) any website an address I send normal e…
$Work does not allow outgoing (out of domain) emails but *Requires* signup to a bunch of websites for stuff like provident fund management and stock compensation. This kind of workflow is not possible for those cases
They are exchanging inconvenience for lack of functionality
Re: Why don’t we do email verification in reverse?
#68Re: Why don’t we do email verification in reverse?
#69Most users have more than 1 email id, some may multiple email apps, in those cases, more work for the user, else it is a 2 click process, 1 for clicking the notification and another for the link.
Re: Why don’t we do email verification in reverse?
#70On a related note, when users want to connect with me I use a mailto link instead of a web form. This is because after someone fills out a webform, I have to email them, and my email is not-infrequently marked as spam (even though we send When the user clicks the mailto link, he starts a message chain and my reply almost always goes through appropriately.
As others have pointed out, there are some downsides to mailto links. But I find them to be outweighed by the deliverability benefit that I've seen.