Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why don’t we do email verification in reverse?

blog.yossarian.net

Post reply on HN
Print view View original

131–140 of 329 posts

Re: Why don’t we do email verification in reverse?

#131

Post by blowski »

arubania2 wrote: post #126
jen729w wrote: post #96

Earlier quoted context omitted.

It assumes that we all have access to our email all of the time. Which is a fair assumption for 99.99% of the population. But I deliberately keep email off my phone, so I don't look at email on my phone. So yes, I hate 'passwordless login'. I have a password manager, I can do it myself thanks very much.

You could consider setting up a separate email account just for the verification messages and have that on your phone.

Why should I have to go through all that faff when I have a perfectly good password manager?

Re: Why don’t we do email verification in reverse?

#132

Post by ThePowerOfFuet »

arubania2 wrote: post #126
jen729w wrote: post #96

Earlier quoted context omitted.

It assumes that we all have access to our email all of the time. Which is a fair assumption for 99.99% of the population. But I deliberately keep email off my phone, so I don't look at email on my phone. So yes, I hate 'passwordless login'. I have a password manager, I can do it myself thanks very much.

You could consider setting up a separate email account just for the verification messages and have that on your phone.

What a pain. Nope.

Re: Why don’t we do email verification in reverse?

#133

Post by sam_lowry_ »

woodruffw wrote: post #98
radu_floricica wrote: post #82

I... don't particularly get it. He mentions spoofing, he writes a page about how spoofing works... but says a lot less about how it actually impacts his solution or how to fix it. Besides the fact that implementing a new security scheme means you have to think through every possible path and can be sure you're still missing a few, there are two major issues: - not everybody has SPF or DKIM, and definitely not everybo…

Author here. The risk with spoofing is that someone might register an email address that they can't actually send mail from. You're right that SPF and DKIM are not universal (besides not being strictly for user authentication); this scheme would require a domain to have both in order to be secure and would require some kind of policy attestation around email local parts, which would exclude some email providers and s…

SPF and DKIM are universal. The proof is transactional email services. There was a time when they sent emails on behalf of clients. Now, they do it on their own account.

Re: Why don’t we do email verification in reverse?

#134

Post by drawfloat »

smt88 wrote: post #18
melvinmelih wrote: post #14

Earlier quoted context omitted.

When I started on my first project as a junior engineer I thought I was being clever to build an app without any passwords: every time you wanted to login you received a new email with a link to log you in. Technically, this worked great but after a while I received many complaints from frustrated users who kept looking for the “signup form”…

You can solve this problem without a signup form. Just give the user two links: sign up and log in. Both ask for email address first. The next screen tells them to check their email. You can use unusual flows without confusing users as long as you give them cues about how to do what they're trying to do.

That doesn’t solve the issue of passwordless login, though, which is the fact not everyone has access to their email on every device at all times.

Need to check something attached to a work email (hello Slack) but purposefully not got work email set up on your personal device? Good luck

Re: Why don’t we do email verification in reverse?

#135

Post by ThePowerOfFuet »

eastbound wrote: post #95
pmontra wrote: post #76

Earlier quoted context omitted.

I do and tell people to do the same. Unfortunately we can't force people to actually do it.

Password managers are a single point of huge vulnerability. Unless password managers have a bug bounty of 3m$, then it’s less than the assets I’m protecting with it. Also, Chrome itself is a password manager.

> Also, Chrome itself is a password manager.

Until the day Google locks your Google Account.

Re: Why don’t we do email verification in reverse?

#136

Post by ThePowerOfFuet »

ShowalkKama wrote: post #122
radu_floricica wrote: post #82

I... don't particularly get it. He mentions spoofing, he writes a page about how spoofing works... but says a lot less about how it actually impacts his solution or how to fix it. Besides the fact that implementing a new security scheme means you have to think through every possible path and can be sure you're still missing a few, there are two major issues: - not everybody has SPF or DKIM, and definitely not everybo…

> - not everybody has SPF or DKIM, and definitely not everybody has DKIM. A correctly configured mailserver should reject your email (or mark it as spam) if you don't use both DKIM and SPF. It's safe to assume 99.999% of users use both.

> It's safe to assume 99.999% of users use both [SPF and DKIM].

Tell me you don't have professional experience in email without telling me you don't have professional experience in email.

Re: Why don’t we do email verification in reverse?

#137

Post by DominikPeters »

ShowalkKama wrote: post #122
radu_floricica wrote: post #82

I... don't particularly get it. He mentions spoofing, he writes a page about how spoofing works... but says a lot less about how it actually impacts his solution or how to fix it. Besides the fact that implementing a new security scheme means you have to think through every possible path and can be sure you're still missing a few, there are two major issues: - not everybody has SPF or DKIM, and definitely not everybo…

> - not everybody has SPF or DKIM, and definitely not everybody has DKIM. A correctly configured mailserver should reject your email (or mark it as spam) if you don't use both DKIM and SPF. It's safe to assume 99.999% of users use both.

I have plenty of emails in my inbox that don't use both. I think you're off by several orders of magnitude.

Re: Why don’t we do email verification in reverse?

#138

Post by b112 »

netheril96 wrote: post #83
melvinmelih wrote: post #14

Earlier quoted context omitted.

When I started on my first project as a junior engineer I thought I was being clever to build an app without any passwords: every time you wanted to login you received a new email with a link to log you in. Technically, this worked great but after a while I received many complaints from frustrated users who kept looking for the “signup form”…

Email is not a secure method of communication.

Nor is SMS. Nor a phone call (even a presumed "landline" can be voip, and that can be hacked too).

Here's the truth ; nothing is "secure".

Now... is email more secure than SMS, or less? What about other 2-factor auth things? Is email secure with 2-factor auth?

Re: Why don’t we do email verification in reverse?

#139

Post by Quekid5 »

arubania2 wrote: post #126
jen729w wrote: post #96

Earlier quoted context omitted.

It assumes that we all have access to our email all of the time. Which is a fair assumption for 99.99% of the population. But I deliberately keep email off my phone, so I don't look at email on my phone. So yes, I hate 'passwordless login'. I have a password manager, I can do it myself thanks very much.

You could consider setting up a separate email account just for the verification messages and have that on your phone.

The site would have to have a hell of a value proposition for that to be worth the effort.

Re: Why don’t we do email verification in reverse?

#140

Post by bmn__ »

arubania2 wrote: post #126
jen729w wrote: post #96

Earlier quoted context omitted.

It assumes that we all have access to our email all of the time. Which is a fair assumption for 99.99% of the population. But I deliberately keep email off my phone, so I don't look at email on my phone. So yes, I hate 'passwordless login'. I have a password manager, I can do it myself thanks very much.

You could consider setting up a separate email account just for the verification messages and have that on your phone.

"No way! Why should I change? He's the one who sucks."
Post reply on HN