This is actually a very good idea. I'm gonna start implementing it on my sites. If you want your account verified, just email the site with anything or nothing at all. Thanks for the idea! Email verification is a nightmare.
Why don’t we do email verification in reverse?
81–90 of 329 posts
Re: Why don’t we do email verification in reverse?
#82I... don't particularly get it. He mentions spoofing, he writes a page about how spoofing works... but says a lot less about how it actually impacts his solution or how to fix it.
Besides the fact that implementing a new security scheme means you have to think through every possible path and can be sure you're still missing a few, there are two major issues:
- not everybody has SPF or DKIM, and definitely not everybody has DKIM.
- both of those authenticate the domain, not the username. Within the local org network I can probably spoof email usernames without much effort.
Plus... I don't think mailto links really work universally. I remember the last time I clicked one it opened an unconfigured Outlook, even though I use gmail.
Re: Why don’t we do email verification in reverse?
#83A general rule of thumb I've built up over the years: resist the temptation to innovate around login! Look at the most commonly used flows that are not obviously terrible and try to implement as close a match to them as possible. When I've tried to innovate around login in the past I've found that any clever ideas I come up with inevitably run into road blocks pretty quickly. Here's one example: why have a separate l…
When I started on my first project as a junior engineer I thought I was being clever to build an app without any passwords: every time you wanted to login you received a new email with a link to log you in. Technically, this worked great but after a while I received many complaints from frustrated users who kept looking for the “signup form”…
Email is not a secure method of communication.
Re: Why don’t we do email verification in reverse?
#84Re: Why don’t we do email verification in reverse?
#85Seems to me like a made up problem. Are there issues with transactional e-mail delivery, just change your provider.
Re: Why don’t we do email verification in reverse?
#86I like the idea but instead of mailto which I find annoying why not simply ask the user to send us an email with a hello message? The email address we provide can be unique per sign up if required.
So no copy pasting of codes, or having a specific format of the email. We just need to check the sender and recipient.
Re: Why don’t we do email verification in reverse?
#87I... don't particularly get it. He mentions spoofing, he writes a page about how spoofing works... but says a lot less about how it actually impacts his solution or how to fix it. Besides the fact that implementing a new security scheme means you have to think through every possible path and can be sure you're still missing a few, there are two major issues: - not everybody has SPF or DKIM, and definitely not everybo…
Yeah I don’t get it. Is this the reasoning?
Email is slow to get to me
I use neomutt (there are dozens of us, dozens!) and so links sometimes are wonky.
So let’s use SPF and DMARC, something totally outside of a regular email user’s control, to do this task. And hope that it works.
Re: Why don’t we do email verification in reverse?
#88I go to website, get mailto link for my work email and send it from my personal email. Then I sit there and wait because there are lots of indeterminate third parties on the way sending my mail on.
Re: Why don’t we do email verification in reverse?
#89Getting Gmail to support "verify" in the same way as it supports unsubscribe will make 99% of these problems go away
Re: Why don’t we do email verification in reverse?
#90So instead of an HTTP syncronous POST request, you want to trade it for a brittle implementation of a to-be-implemented-standard that requires the sending email client to be on point? And that I will wait while my outgoing email server isn't delayed?
And what if I use my ISP provided email, and move? Am I just locked out of accounts?
I appreciate the thought process of rethinking our assumptions. But this is not fruitful - the tradeoffs are trivially obvious and unacceptable failure modes.