Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why don’t we do email verification in reverse?

blog.yossarian.net

Post reply on HN
Print view View original

121–130 of 329 posts

Re: Why don’t we do email verification in reverse?

#121

Post by woodruffw »

IncRnd wrote: post #10

This is not well reasoned. Sending emails can be easily spoofed, because sending doesn't fully check the identity of the sender as being in control of the email account. There is discussion of various technologies like SPF or DKIM, but those are not universally applied. When they are applied, there isn't universal quality in their application. The crux of verification using an email account is that the person _contro…

> This is not well reasoned. Sending emails can be easily spoofed, because sending doesn't fully check the identity of the sender as being in control of the email account. There is discussion of various technologies like SPF or DKIM, but those are not universally applied. When they are applied, there isn't universal quality in their application.

I bring up both of these at the end of the post, under "potential limitations." I'm very aware that SPF/DKIM don't do identity authentication, and that they're not universally applied!

This post is best read as a random thought, not an exhortation or formal argument. It says as much in the first sentence.

Re: Why don’t we do email verification in reverse?

#122

Post by ShowalkKama »

radu_floricica wrote: post #82

I... don't particularly get it. He mentions spoofing, he writes a page about how spoofing works... but says a lot less about how it actually impacts his solution or how to fix it. Besides the fact that implementing a new security scheme means you have to think through every possible path and can be sure you're still missing a few, there are two major issues: - not everybody has SPF or DKIM, and definitely not everybo…

> - not everybody has SPF or DKIM, and definitely not everybody has DKIM.

A correctly configured mailserver should reject your email (or mark it as spam) if you don't use both DKIM and SPF. It's safe to assume 99.999% of users use both.

Re: Why don’t we do email verification in reverse?

#123

Post by LinAGKar »

simonw wrote: post #5

A general rule of thumb I've built up over the years: resist the temptation to innovate around login! Look at the most commonly used flows that are not obviously terrible and try to implement as close a match to them as possible. When I've tried to innovate around login in the past I've found that any clever ideas I come up with inevitably run into road blocks pretty quickly. Here's one example: why have a separate l…

Sounds like a lot of people would accidentally create new accounts.

Re: Why don’t we do email verification in reverse?

#124

Post by DoubleFree »

In general, you don't verify am email address to prove that the user owns it, but to verify they can receive mail on it, for password recovery purposes and account information. Reversing the process verifies the user can send from the address, which is orthogonal to the goal

Re: Why don’t we do email verification in reverse?

#125

Post by k_sze »

I see two problems with the proposal

  1. Part of the reason for doing e-mail verification the old way is to ensure the user can really receive messages at the particular address, for purposes such as password reset or e-mail notifications in the future. The proposed novel verification flow only verifies that the user can *send* e-mails, not receive.
  2. My phone is configured with multiple mail accounts. I don’t remember whether you can reliably hint at the mail client to use a particular mail account via a mailto link.

Re: Why don’t we do email verification in reverse?

#126

Post by arubania2 »

jen729w wrote: post #96
jcelerier wrote: post #36

Earlier quoted context omitted.

Oh the few websites that do this drive me absolutely crazy. It makes me immediately look for alternatives, it's unbearable

It assumes that we all have access to our email all of the time. Which is a fair assumption for 99.99% of the population. But I deliberately keep email off my phone, so I don't look at email on my phone. So yes, I hate 'passwordless login'. I have a password manager, I can do it myself thanks very much.

You could consider setting up a separate email account just for the verification messages and have that on your phone.

Re: Why don’t we do email verification in reverse?

#127

Post by makeitdouble »

LinAGKar wrote: post #123
simonw wrote: post #5

A general rule of thumb I've built up over the years: resist the temptation to innovate around login! Look at the most commonly used flows that are not obviously terrible and try to implement as close a match to them as possible. When I've tried to innovate around login in the past I've found that any clever ideas I come up with inevitably run into road blocks pretty quickly. Here's one example: why have a separate l…

Sounds like a lot of people would accidentally create new accounts.

People do go back to the signup page a lot. Redirecting them when detecting an existing account from the email is enough in the most common cases.

Users doing "clever" stuff like a random email each time, will also probably understand the situation when they go write down which email for which domain they used and see another entry next to it.

There will be some numbers of users that can't be caught and will create many new accounts, but if thwy use your seevice that much, it will probably stop at one point.

Nothing is foolproof, but there can be many ways to mitigate the issue.

Re: Why don’t we do email verification in reverse?

#129

Post by nice2meetu »

woodruffw wrote: post #98
radu_floricica wrote: post #82

I... don't particularly get it. He mentions spoofing, he writes a page about how spoofing works... but says a lot less about how it actually impacts his solution or how to fix it. Besides the fact that implementing a new security scheme means you have to think through every possible path and can be sure you're still missing a few, there are two major issues: - not everybody has SPF or DKIM, and definitely not everybo…

Author here. The risk with spoofing is that someone might register an email address that they can't actually send mail from. You're right that SPF and DKIM are not universal (besides not being strictly for user authentication); this scheme would require a domain to have both in order to be secure and would require some kind of policy attestation around email local parts, which would exclude some email providers and s…

This was my first thought. I just have a * rule on my domain hosting account to send all email to my gmail, but can’t actually send from any of those addresses. I’ll usually sign up with website@mydomain.com
Post reply on HN