Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lies we tell ourselves about email addresses

gitpush--force.com

Post reply on HN
Print view View original

11–20 of 197 posts

Re: Lies we tell ourselves about email addresses

#11

Post by farfatched »

jeffbee wrote: post #8

This article says that Gmail can't handle address literals. I personally wrote the IPv6 address literal support for Gmail, so this annoys me. I just tested it and it shortened "[IPv6:2001:etc:etc::192.etc.etc]" down to "@2001" then generated an extremely terse mail delivery subsystem notification that I've never seen before. Which is why you should never just rewrite software without understanding why all the test ca…

Could they have consciously chosen to remove that functionality?

E.g. to simplify code, or if they wanted all mails to have a domain (if, for example, they wanted to integrate with reputation systems that were domain oriented)?

Re: Lies we tell ourselves about email addresses

#12

Post by sohex »

IIIRC in terms of clients mutt (&co) will actually handle “@“ in the local part correctly.

> But the real reason I do that is just because I just like to sit in anger whenever this breaks the user experience because of programming errors or inconsistencies.

Genuinely delighted by the fact that I’m not alone in that.

Re: Lies we tell ourselves about email addresses

#13

Post by gerdesj »

Email is just like physical mail and thankfully just as endearingly human (sometimes).

Once upon a time (1970/80s) I lived on and off in a mystic land called West Germany. Our postal addresses ended with incantations such as BFPO 40.

Around 1985ish my granny send a Christmas card to us. I should note that she was at this time nearly seventy and sadly suffering from Parkinsons. She addressed the card, in rather crabbed but legible handwriting, to:

Graham and Heath BFPO 40

My mum's name is abbreviated - her daughter. At that time Rheindahlen (nr Moenchengladbach) had a pretty large contingent of Brits in it - it was HQ (BAOR).

The card arrived well before Chrimbo and it took about a week judging by the post mark, which was petty normal in those days. She shoved it into a post box in Ipplepen, nr Newton Abbot, Devon and it found its way to an obscure address in another country. I seem to recall she also forgot the stamp but it still got through.

I'm sure mail like that becomes a point of honour to deliver and HM PO and BFPO did the job admirably.

That attitude is how email MTAs are generally designed to work. They cling on to the good old days and sadly the world is a bit shit. Case sensitivity ... lol!

Re: Lies we tell ourselves about email addresses

#14

Post by jeffbee »

farfatched wrote: post #11
jeffbee wrote: post #8

This article says that Gmail can't handle address literals. I personally wrote the IPv6 address literal support for Gmail, so this annoys me. I just tested it and it shortened "[IPv6:2001:etc:etc::192.etc.etc]" down to "@2001" then generated an extremely terse mail delivery subsystem notification that I've never seen before. Which is why you should never just rewrite software without understanding why all the test ca…

Could they have consciously chosen to remove that functionality? E.g. to simplify code, or if they wanted all mails to have a domain (if, for example, they wanted to integrate with reputation systems that were domain oriented)?

Based on the incredibly basic bounce message, I suspect the problem is that the frontend eats the address before it even gets to delivery.

To your question, yes any product decision is possible, but enterprise/government people are surprisingly demanding about this stuff working because they have extremely weird requirements for routing mail to and through legacy systems. So I bet this still works at the mailer level and is broken in the UI.

Re: Lies we tell ourselves about email addresses

#15

Post by readthenotes1 »

denkmoon wrote: post #9
CPLX wrote: post #7

Earlier quoted context omitted.

> Clickable links sent in email are more secure than passwords so I'll stop supporting passwords and instead rely on email delivery of a link for all logins God, I fucking hate that. I have a fucking password manager, I have various machines and things open. Just let me fucking log in. If anyone is reading this who is in charge of the internet please stop doing this.

The people in charge of the internet are "cybersecurity" "professionals" who can't even follow NIST guidance.

The "change your password every 6 months" guidance?

Re: Lies we tell ourselves about email addresses

#16

Post by trumpdong »

amiga386 wrote: post #3

Add the lie "emails are delivered instantly, so the user can click a link I email them within 1 minute" And the lie "users always read emails on the same device they're logging into a website with" And the lie "users can always view HTML email so no need to send a plaintext equivalent, especially if I have a long complex URL I want them to click" And the lie "Clickable links sent in email are more secure than passwor…

If you try to create a Discord account with Firefox Klar as your default browser, on Android, immediately upon signing up you'll be banned. I have to assume this is because it clears cookies and thinks you're a bot farm.

Re: Lies we tell ourselves about email addresses

#17

Post by trumpdong »

readthenotes1 wrote: post #15
denkmoon wrote: post #9

Earlier quoted context omitted.

The people in charge of the internet are "cybersecurity" "professionals" who can't even follow NIST guidance.

The "change your password every 6 months" guidance?

That was revoked some years ago.

Re: Lies we tell ourselves about email addresses

#18

Post by roygbiv2 »

CPLX wrote: post #7
amiga386 wrote: post #3

Add the lie "emails are delivered instantly, so the user can click a link I email them within 1 minute" And the lie "users always read emails on the same device they're logging into a website with" And the lie "users can always view HTML email so no need to send a plaintext equivalent, especially if I have a long complex URL I want them to click" And the lie "Clickable links sent in email are more secure than passwor…

> Clickable links sent in email are more secure than passwords so I'll stop supporting passwords and instead rely on email delivery of a link for all logins God, I fucking hate that. I have a fucking password manager, I have various machines and things open. Just let me fucking log in. If anyone is reading this who is in charge of the internet please stop doing this.

I seem to spend half my life logging into thing's, confirming 2fa,confirming biometric data. Then when I go back to the first thing it's timed out and I have to sign in again.

Re: Lies we tell ourselves about email addresses

#19

Post by jiveturkey »

> TL;DR: Don't overthink it, just send a verification email.

pretty bad advice, if taken only as written, without adding more flavor on top.

the major email providers will penalize you if you generate too many undeliverable emails. thus, if you just send a verification email without any pre-validation, it's pretty easy to get into a DoS situation where current/valid users don't get important email sent to them, or that email is significantly delayed, plus incur huge operating cost to resolve the problem.

some form of rate limiting is needed, plus IMHO it's better to use a verifier service or your own heuristic or ML model to test for email validity including valid but fake/spammy/disposable addresses.

sorry, but we are way past the point of being able to have nice things, esp. when we're talking about email.

the "lies" part of the content is great. people do assume all those wrong things. however the TLDR is just wrong, and potentially harmful.

Re: Lies we tell ourselves about email addresses

#20

Post by nosioptar »

amiga386 wrote: post #3

Add the lie "emails are delivered instantly, so the user can click a link I email them within 1 minute" And the lie "users always read emails on the same device they're logging into a website with" And the lie "users can always view HTML email so no need to send a plaintext equivalent, especially if I have a long complex URL I want them to click" And the lie "Clickable links sent in email are more secure than passwor…

When I had protonmail, I often wouldn't get emails for hours, sometimes a day.

Most other providers I've used range from instant to a few minutes.

Post reply on HN