Why don’t we do email verification in reverse? • Hacker News Board

Re: Why don’t we do email verification in reverse?

#281

Post by ipaddr » Sun, Aug 21, 2022, 4:19 PM UTC

speedgoose wrote: post #249

ipaddr wrote: post #227

Earlier quoted context omitted.

Your single point will be compromised. Someone gets access to your system they now have access to all of your passwords. Your password manager is hacked. Your device dies. Putting your eggs in one basket feels like a smart thing until you lose that basket.

I agree it’s not perfect but what is your better solution? My email and some passwords have been collected at least 8 times according to https://haveibeenpwned.com/ A password manager with multiple factor authentication sounds better to me.

The different email address per service approach fixes that issue and provides additional privacy when your data is sold to bulk data resellers.

Re: Why don’t we do email verification in reverse?

#282

Post by SergeAx » Sun, Aug 21, 2022, 4:32 PM UTC

Banana699 wrote: post #213

SergeAx wrote: post #199

I will rant here a bit. I say: let them experiment. Let this guy implement his clever scheme and see how spam bots population increases several folds and conversion drops 10-15%. If he knows what conversion is and have a metrics for it. And knows what metrics are, also. And if spammers are interested at all in his product. Or whatever. Also let the legion of newbies and dilettantes vote articles like this to the moon…

Why so extremely aggressive?

Because I used to reap HNs first page rich of great content, but lately it becomes more and more lame, like this one, or repeating same old stories. It is disappointing and annoying. I have no explanation other than upvoting crowd became meh.

Re: Why don’t we do email verification in reverse?

#283

Post by somenewaccount1 » Sun, Aug 21, 2022, 4:37 PM UTC

For all the reasons mentioned here, and some the author wavy-hands away, this is a bad idea.

None the less, I learned more about email spoofing from this article then from any other, so it's a nice read.

Re: Why don’t we do email verification in reverse?

#284

Post by marcosdumay » Sun, Aug 21, 2022, 4:37 PM UTC

simonw wrote: post #5

A general rule of thumb I've built up over the years: resist the temptation to innovate around login! Look at the most commonly used flows that are not obviously terrible and try to implement as close a match to them as possible. When I've tried to innovate around login in the past I've found that any clever ideas I come up with inevitably run into road blocks pretty quickly. Here's one example: why have a separate l…

> When I've tried to innovate around login in the past I've found that any clever ideas I come up with inevitably run into road blocks pretty quickly.

Either that or you are throwing roadblocks in your user's way. Even if there is no reason for the most common UX to be the way they are, it is what users are used to, and know how to deal with.

Re: Why don’t we do email verification in reverse?

#285

Post by groby_b » Sun, Aug 21, 2022, 4:48 PM UTC

We don't do it in reverse because sender addresses are fairly trivial to spoof? What email verification proves is your ability to read email (which means password possession), which is much harder to fake.

Re: Why don’t we do email verification in reverse?

#286

Post by paxys » Sun, Aug 21, 2022, 4:52 PM UTC

Seems like a bizarrely convoluted solution in search of a problem. Sending a verification email and clicking on a link in it works perfectly well for 99.99% of users. This new method increases friction by several orders of magnitude.

Re: Why don’t we do email verification in reverse?

#287

Post by remram » Sun, Aug 21, 2022, 5:04 PM UTC

_8j50 wrote: post #273

remram wrote: post #236

Earlier quoted context omitted.

People forget their passwords. If you do more than sell stuff one time and the user really need to get their account back, you need a way to send them a reset link or code. No way around it.

Only if you or the user refuse to use federated auth. And even then do you not have 2FA? Then your 2FA is reduced to 1FA by email? "There is no way around it" is such b.s., yes there is, pretend email does not exist, how would you do it? I think you skipped over parts of my post, there is a myriad of messaging applications if you insist control over some external account is the way to go. But really, the ideal way to…

Email can replace only the password, leaving you with 2FA still.

Another messaging channel is fine of course. You could replace email address by a phone number for SMS/WhatsApp/Signal. Is that more secure though? Would a user rather give your random app their phone number than email address?

Secret questions are usually very much not secret (less safe than password). They are way easier to uncover about a person, and still very much subject to re-use across sites.

I am telling you that I haven't found anything as good and you reply that I must not have taken a single minute to think about it. I guess there's nothing more for us to discuss.

Re: Why don’t we do email verification in reverse?

#288

Post by pmontra » Sun, Aug 21, 2022, 5:11 PM UTC

988747 wrote: post #149

pmontra wrote: post #76

Earlier quoted context omitted.

I do and tell people to do the same. Unfortunately we can't force people to actually do it.

Firefox is great in that regard: when you fill in a signup form it will automatically suggest you a long, generated password, and will then store it for you.

This is news for me. I've been using a local password manager for ages and disabled any browser form support since maybe the last century so I missed all those new functionalities. I'll keep using my password manager anyway, it's not only for the browser and not only for one device. I sync the db across devices with Syncthing, I don't login into any browser cloud sync.

Re: Why don’t we do email verification in reverse?

#289

Post by phpisthebest » Sun, Aug 21, 2022, 5:16 PM UTC

arinlen wrote: post #200

maccard wrote: post #182

Earlier quoted context omitted.

Thats a crazy level of risk assessment for an average user. > how does your password manager help you if your email password gets leaked? You still need my TOTP codes in my case at least, which conveniently are stored in my password manager. Is it perfectly secure? No, of course it's not, but frankly my risk profile isn't worrying about a targeted attack on me and my password manager, it's worrying about leaked share…

> Thats a crazy level of risk assessment for an average user. It really isn't. Think about it for a second: how hard is it to spot phishing attempts when they are sent to an email address you know for a fact you're not using with a service? And how vulnerable are you to phishing if your special-purpose email address that you only use for one specific purpose receives zero spam? To claim that the most basic and easy i…

>>Think about it for a second

Perhaps instead of telling everyone to think on things for a second, you should think on things for longer than a second?

>And how vulnerable are you to phishing if your special-purpose email address that you only use for one specific purpose receives zero spam?

This would depend on how you setup the email address, if it truly a separate email address i.e a separate account not just an alias then phishing is not the concern but management of the accounts becomes a huge problem

I use separate alias's for every service against my own custom domain that has a single email account. This is not to prevent phishing but to detect when a breach occurred or when my info is sold, you assume that when you sign up for a service only that service will ever have access to your info, many many many companies and service sell your email address to marketers.

Re: Why don’t we do email verification in reverse?

#290

Post by artur_makly » Sun, Aug 21, 2022, 5:17 PM UTC

Has anyone simply tried NOT using any email verification? Sure there will be a Low % of mis-keyed or fake emails.. but it does remove a HUGE wall and reduces TimeToFirstAppExperience.