Email verification protocol
github.com
Email verification protocol
1–10 of 151 posts
Re: Email verification protocol
#2Verify email addresses automatically
Re: Email verification protocol
#3> User privacy is enhanced as the issuer does not learn which web application is making the request as the request is mediated by the browser.
This seems extremely marginal. The point of verifying an email address is to subsequently use it to send email.
Re: Email verification protocol
#4Might want to take a look at https://github.com/zkemail
Re: Email verification protocol
#5This is what Mozilla Persona did, too. I loved the UX, but it wasn't very successful, unfortunately.
Re: Email verification protocol
#6This is what Mozilla Persona did, too. I loved the UX, but it wasn't very successful, unfortunately.
Apparently Persona was even based on some prior work called "VerifiedEmailProtocol", eerily similar to the OP
Re: Email verification protocol
#7> User privacy is enhanced as the issuer does not learn which web application is making the request as the request is mediated by the browser.
How can you avoid revealing the application through the `Origin` header?
Re: Email verification protocol
#8Hard to see how this provides substantial benefits over OIDC. Either one requires support from the email provider, but one is already standardized and has widespread support.
Re: Email verification protocol
#9"There are privacy implications as the email transmission informs the mail service the applications the user is using and when they used them."
Not really, as I can enter any email on a service login page that uses magic links for auth. The owner of that email will receive the login link but that doesn't mean they tried to login on that system.
Re: Email verification protocol
#10Why must apps require email? Why not only username and password?