Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why don’t we do email verification in reverse?

blog.yossarian.net

Post reply on HN
Print view View original

301–310 of 329 posts

Re: Why don’t we do email verification in reverse?

#301

Post by woodruffw »

vbezhenar wrote: post #180
woodruffw wrote: post #172

Earlier quoted context omitted.

This is simultaneously true and not useful: most people use an email provider, and the provider dictates the spam policy. Aggressive policies are competitive, because spam annoys users more than the occasional missed message.

> spam annoys users more than the occasional missed message. For me it's the other way around. I don't care about occasional spam. But the possibility of missing message means that I'm forced to read ALL spam periodically.

I think there's a paradox here: I also don't care about occasional spam, and the possibility of missing messages matters much more to me. But I probably wouldn't select an email provider with no spam protections at all, and Google is optimizing for new user registrations.

Re: Why don’t we do email verification in reverse?

#302

Post by indymike »

perlgeek wrote: post #100

Some potential problems: * not everybody has an email client set up that works with mailto: links * sending from an address and receiving emails for an address are very different, and they don't map 1:1 * If you rely on users sending mail to you, the user doesn't know if / when their email is received and processed. They send the mail, try to login, it doesn't work. They have to wait until it's processed, and then fo…

> not everybody has an email client set up that works with mailto: links

Mostly bad chrome configs where you need to browser plugin to lauch chrome.

>I doubt that DMARC/DKIM/SPF are actually deployed as widely as OP thinks, and excluding users based on some (to them) obscure/unknown feature of their email provider is bound to generate frustration.

We're at about 30% with DMARC and SPF being deployed in about 65% of email servers. That said, a lot of the really big ones (google, MS, etc...) are in the 30% so are a lot of control panel hosts. Where the slow uptake is, as always is corporate IT departments. Doing the whole DMARC/DKIM/SPF dance isn't hard to do and really puts the clamps on spoofing.

Re: Why don’t we do email verification in reverse?

#303

Post by indymike »

ozim wrote: post #104
gingerlime wrote: post #30

Besides the security and usability problems others mentioned, I also highly doubt it will improve confirmation conversions. One thing that helped us improve confirmations -- we A/B tested it and confirmation rates increased ~8%: send a 4-digit confirmation code rather than just a link. It's easier and more familiar on mobile, especially if you see the code on the push notification, so don't even need to open the emai…

Not having a link in email is important. I believe most of the times email from my systems go to spam because there is a link in it. I don't have any hard data but I can imagine that if email contains link it will be checked by more rules in heuristic checks. If there are no links - most likely it is not spam.

> email from my systems go to spam because there is a link in it.

This spam filter is broken. A personal email with a signature that contains a blog would be a false positive.

Re: Why don’t we do email verification in reverse?

#304

Post by [deleted] »

arubania2 wrote: post #126
jen729w wrote: post #96

Earlier quoted context omitted.

It assumes that we all have access to our email all of the time. Which is a fair assumption for 99.99% of the population. But I deliberately keep email off my phone, so I don't look at email on my phone. So yes, I hate 'passwordless login'. I have a password manager, I can do it myself thanks very much.

You could consider setting up a separate email account just for the verification messages and have that on your phone.

[deleted]

Re: Why don’t we do email verification in reverse?

#305

Post by ozim »

indymike wrote: post #303
ozim wrote: post #104

Earlier quoted context omitted.

Not having a link in email is important. I believe most of the times email from my systems go to spam because there is a link in it. I don't have any hard data but I can imagine that if email contains link it will be checked by more rules in heuristic checks. If there are no links - most likely it is not spam.

> email from my systems go to spam because there is a link in it. This spam filter is broken. A personal email with a signature that contains a blog would be a false positive.

Well that is not a full story.

But if you have a link in an email it will go through couple of other checks for sure, where it might be considered SPAM. If there are no links bunch of checks will be skipped.

That is my reasoning, I am not configuring any spam filters on my own.

Re: Why don’t we do email verification in reverse?

#306

Post by avodonosov »

awinder wrote: post #276
avodonosov wrote: post #146

Why do we do email verification at all? The only legit and practical reason on most web sites is to be able to restore access if you forgot the password. So just near the password field we can have a "Restore options" section, with email, phone number, etc fields; each having a Test button. If user have entered email address he can use the Test button and receive a confirmation email, with a link. When user clicks th…

Most webapps have a need for transactional messaging of some sort. But even putting that aside you’re missing TOS support. Every TOS is going to have conditions that define scenarios where you need to communicate with users. Including changes to the terms of service ;-). Or for breaches of data, you’ll want/contractually need to communicate that to your users. So yeah you could build different options for all of thes…

Good point about TOS, that's indeed an important use case. However usually TOS declare that it is a responsibility of the user to keep up with changes. Good service providers also say they will make a reasonable effort to inform the user about the changes. So the TOS update notifications is not a complete blocker for my approach.

What do you mean by transactional messaging? Could you give an example?

Re: Why don’t we do email verification in reverse?

#307

Post by eptcyka »

ipaddr wrote: post #227
speedgoose wrote: post #107

Earlier quoted context omitted.

It’s still better than using the same few passwords everywhere or having a system with the site name. Because you need only on website vulnerability, which is quite common, to compromise your passwords. It’s better to have a single unlikely point of failure than many guaranteed points of failure in my opinion. Chrome has a password manager but the key is stored for you, which is less secure because it’s not using a H…

Your single point will be compromised. Someone gets access to your system they now have access to all of your passwords. Your password manager is hacked. Your device dies. Putting your eggs in one basket feels like a smart thing until you lose that basket.

My password manager can only decrypt my passwords via my yubikey. What now?

Re: Why don’t we do email verification in reverse?

#308

Post by scrollaway »

nickjj wrote: post #250
remram wrote: post #233

Earlier quoted context omitted.

"Logging in" typically refers to the situation where you don't have the cookie and need to get it. Having the cookie is typically referred to as "being logged in" already.

> "Logging in" typically refers to the situation where you don't have the cookie and need to get it. Right, and after you click the link in your email to login then your back-end will set a cookie so that when you close your browser and come back again you will be logged in without needing to receive another link your email for however long you want "remember me" to be available. The person I was replying to said the…

Dude, you're describing logging in.

If I don't have cookies, I have to receive that email again, and it introduces a large amount of failure points EVERY SINGLE TIME this login happens. Instead of just once, on account verification.

Seriously, I've built enough apps that require email verification to know how much of a failure point that email verification is, and it's a significant draw on onboarding when email guarantees are required early on. Doing it every single login (= every new device, every new incognito session, every now and then when the user clears their cache, every time they switch browser, every time they log in from a new computer, etc etc) is insanity, and again, everyone I know who uses magic link has given up on them, or made them extremely optional.

Re: Why don’t we do email verification in reverse?

#309

Post by nickjj »

scrollaway wrote: post #308
nickjj wrote: post #250

Earlier quoted context omitted.

> "Logging in" typically refers to the situation where you don't have the cookie and need to get it. Right, and after you click the link in your email to login then your back-end will set a cookie so that when you close your browser and come back again you will be logged in without needing to receive another link your email for however long you want "remember me" to be available. The person I was replying to said the…

Dude, you're describing logging in. If I don't have cookies, I have to receive that email again, and it introduces a large amount of failure points EVERY SINGLE TIME this login happens. Instead of just once, on account verification. Seriously, I've built enough apps that require email verification to know how much of a failure point that email verification is, and it's a significant draw on onboarding when email guar…

We must use computers much differently.

I don't login from new computers often, I have my personal machine and mobile phone. It's great to be able to login from a phone without needing a password manager or manually typing a 50 character randomly generated password where I need to be sitting in front of my main computer to even login. If you really have that many computers you'd still need to sync a password manager between all of them to login with a password.

I also don't browse with incognito mode on sites where I'm expected to be logged in unless I have multiple accounts that I want to have logged in simultaneously.

I also don't routinely switch browsers and if I do I only have to login once per browser and I'm done for a year or however long the site saves it for.

That doesn't sound like insanity to me? I didn't even think about them while writing my original reply because they are such outlier events.

Re: Why don’t we do email verification in reverse?

#310

Post by scrollaway »

nickjj wrote: post #309
scrollaway wrote: post #308

Earlier quoted context omitted.

Dude, you're describing logging in. If I don't have cookies, I have to receive that email again, and it introduces a large amount of failure points EVERY SINGLE TIME this login happens. Instead of just once, on account verification. Seriously, I've built enough apps that require email verification to know how much of a failure point that email verification is, and it's a significant draw on onboarding when email guar…

We must use computers much differently. I don't login from new computers often, I have my personal machine and mobile phone. It's great to be able to login from a phone without needing a password manager or manually typing a 50 character randomly generated password where I need to be sitting in front of my main computer to even login. If you really have that many computers you'd still need to sync a password manager…

Great, you're one user who likes magic links. It doesn't matter how you (nor I, for that matter) use magic links, the majority of users dislike them for the reasons I highlighted.

When building a site/service/ui/whatever, you take into account the needs of your users, not your own needs exclusively.

You asked: "I really don't understand why so many folks hate magic links." - I responded with an explanation.

Post reply on HN