Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why don’t we do email verification in reverse?

blog.yossarian.net

Post reply on HN
Print view View original

141–150 of 329 posts

Re: Why don’t we do email verification in reverse?

#141

Post by deadbunny »

LinAGKar wrote: post #123
simonw wrote: post #5

A general rule of thumb I've built up over the years: resist the temptation to innovate around login! Look at the most commonly used flows that are not obviously terrible and try to implement as close a match to them as possible. When I've tried to innovate around login in the past I've found that any clever ideas I come up with inevitably run into road blocks pretty quickly. Here's one example: why have a separate l…

Sounds like a lot of people would accidentally create new accounts.

There is a site I use that does this. I try and use $sitename@domain.tld as the email for most things I sign up to. Occasionally this gets wonky like the site in question because it was originally a Patreon sub for access so the email for the site was patreon@domain.tld then they switched to their own payment system but my email for them is now locked to patreon@domain.tld.

So when I log in with sitename@domain.tld it thinks it's new account and just signs you up as a new user rather than saying you don't have an account.

Now imagine having a bad day and you try and sign in with 5 different emails because you forgot wha one it was and snow you have 5 different "new account" flows with all the bullshit +12+24+48 hour onboarding/retention/marketing emails for all 5 email addresses.

My fault entirely obviously but it is a little mad.

Re: Why don’t we do email verification in reverse?

#142

Post by yunohn »

simonw wrote: post #3
neximo64 wrote: post #2

Some reasons: - Not everyone will have set email up on the phone. - If a laptop is used it adds more complexity if the email is not set up on the device, (or e.g if Gmail is used via a web browser) - Not everyone will use the Mail app as default and will need to pick the right app - There may be multiple emails and additional complexity to pick the right 'from' if there are multiple emails being used. - It is a test…

Right: this would fail for me on my laptop, because I use gmail for email and don't have anything setup such that a mailto: link would compose a new email from my gmail account.

It’s actually quite easy to set this up, if you missed doing so when it asks:

https://support.google.com/a/users/answer/9308783?hl=en

Re: Why don’t we do email verification in reverse?

#143

Post by sokoloff »

woodruffw wrote: post #98
radu_floricica wrote: post #82

I... don't particularly get it. He mentions spoofing, he writes a page about how spoofing works... but says a lot less about how it actually impacts his solution or how to fix it. Besides the fact that implementing a new security scheme means you have to think through every possible path and can be sure you're still missing a few, there are two major issues: - not everybody has SPF or DKIM, and definitely not everybo…

Author here. The risk with spoofing is that someone might register an email address that they can't actually send mail from. You're right that SPF and DKIM are not universal (besides not being strictly for user authentication); this scheme would require a domain to have both in order to be secure and would require some kind of policy attestation around email local parts, which would exclude some email providers and s…

Most sites I sign up using an email that I could, but don’t send email from. I assign per-site emails which all forward to another mailbox that I regularly send mail from.

I could change my client temporarily to send from one of those custom addresses, but I’d have to be quite a bit more interested than usual in your service to bother.

Even users who just have multiple emails in their client would end up sending mail from the default account, which may not match. I have a work account, my personal gmail, my personal domain mail, a family email account, and a side project email account on my phone.

Even if users just have work and personal, how many users are you willing to lose because they sent a mail from the wrong account?

I also think most of the value to the site owner is being able to hit the user with a site->user communication (often an ad or offer of some sort) and me proving I can send you mail from that address is, at a minimum, putting the emphasis on the wrong syllable, and in a lot of cases is telling you nothing about my ability to receive email at that address.

Re: Why don’t we do email verification in reverse?

#144

Post by autoexec »

mdmglr wrote: post #110

> Plaintext alternatives are the solution, but support is spotty. Very few people use plaintext email clients. According to campaign monitor [1] 67% of users are using graphical email clients. > Takeaway: Inbox delivery can be fickle, unreliable, or outright impossible. The proposed solution to use `mailto:` is also fickle. Users may not have their email client setup or the right client configured in the browser. Als…

> According to campaign monitor [1] 67% of users are using graphical email clients.

That same site also says: "Create a plain text version of your email."

Re: Why don’t we do email verification in reverse?

#145

Post by kqr »

simonw wrote: post #5

A general rule of thumb I've built up over the years: resist the temptation to innovate around login! Look at the most commonly used flows that are not obviously terrible and try to implement as close a match to them as possible. When I've tried to innovate around login in the past I've found that any clever ideas I come up with inevitably run into road blocks pretty quickly. Here's one example: why have a separate l…

At the same time, the whole idea of a shared secret instead of asymmetric crypto is source to so many leaks that I wish we would pressure services to not use password-based authentication as their default.

Re: Why don’t we do email verification in reverse?

#146

Post by avodonosov »

Why do we do email verification at all?

The only legit and practical reason on most web sites is to be able to restore access if you forgot the password.

So just near the password field we can have a "Restore options" section, with email, phone number, etc fields; each having a Test button.

If user have entered email address he can use the Test button and receive a confirmation email, with a link. When user clicks the link, we mark the email as confirmed in DB.

Also, as long as the user does not have a [tested] restore option, we can show him some indicator, like a small red circle on his profile symbol with a tooltip "no restore option configured".

Doing the test email in reverse for me personally would be annoying, because I do not have and do not want to have a configured email client.

Re: Why don’t we do email verification in reverse?

#149

Post by 988747 »

pmontra wrote: post #76
m00x wrote: post #37

Earlier quoted context omitted.

Use a password manager. Problem solved.

I do and tell people to do the same. Unfortunately we can't force people to actually do it.

Firefox is great in that regard: when you fill in a signup form it will automatically suggest you a long, generated password, and will then store it for you.
Post reply on HN