Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lies we tell ourselves about email addresses

gitpush--force.com

Post reply on HN
Print view View original

71–80 of 197 posts

Re: Lies we tell ourselves about email addresses

#71

Post by layer8 »

wolrah wrote: post #41
farfatched wrote: post #10

> It’s likely that more people out there are being filtered by badly-implemented form validation than there are being filtered by their own need of hand-holding. I wish this was asserted with evidence. The author might suggest this because they have unrealistic views of some users. > In the year of our lord 2026, you can reasonably expect your users to know how to type their own email address - or even better, auto-i…

That's why the article says "verify, not validate". Send an email, have a process for them to confirm they received it. If the user gets the email and completes the validation, the email is valid. If they fucked up, they don't get the email and the account never gets created. No one ever gets prevented from creating an account with a legitimate email address, as opposed to "opinionated validation" where that absolute…

While I’m opposed to opinionated validation as well, you seem to be missing the issue it tries to solve, which is the user mistyping their email address, not receiving the verification email, and either thinking everything is fine, or thinking that the process is borked, and in any case not proceeding and not becoming your customer. The goal of opinionated validation is to inform the user about an incorrect email address immediately when they are entering it, so they can correct it right away.

Re: Lies we tell ourselves about email addresses

#72

Post by AndroTux »

JimTheMan wrote: post #43
riddley wrote: post #42

I have a gmail address that at least three other people think is their address. I constantly get emails for the dumb stuff they sign up for. NONE of them ever have an "I didn't request this" link. I mean, I get it. That won't make them money, but oh man is it annoying.

I get scammers using my email to sign up for websites, but they very obviously cannot login to my account. I often wonder what is in it for them. I'm sure someone on HN can tell me!

I assume they just need a valid email address to put in and hope they can use the service without email verification.

Re: Lies we tell ourselves about email addresses

#73

Post by julian_t »

"Email addresses always have a 'normal' TLD"

I registered a ".consulting" domain for my little company when they became available, and it has proved highly problematic ever since. Strangely (or perhaps not) it seems to be the larger players that have the most problems. I would at lest have expected ISPs and comms companies to keep up with this (looking at you, Three)

Re: Lies we tell ourselves about email addresses

#74

Post by zenoprax »

miningtcup wrote: post #45

I would like to point out that the "suggested" validation pattern, ^[^@]+@[^@\s]+$, can filter out valid addresses. "user@something"@example.com is a valid address, and excluding @'s in the user part rejects it.

> "user@something"@example.com is a valid address

I appreciate your commitment to correctness but like [XKCD 1172](https://xkcd.com/1172/) ... the user is clearly in the wrong at this point.

Re: Lies we tell ourselves about email addresses

#75

Post by AndroTux »

TZubiri wrote: post #63

Soooo, let's just send a validation email and if they confirm the code, then it's a valid email? Functionally there's no false positives or false negatives

There's a lot of false negatives because emails get stuck for hours, get blocked by the spam filter or fail to be delivered for whatever reasons.

Re: Lies we tell ourselves about email addresses

#76

Post by AndroTux »

teo_zero wrote: post #58
jiveturkey wrote: post #19

> TL;DR: Don't overthink it, just send a verification email. pretty bad advice, if taken only as written, without adding more flavor on top. the major email providers will penalize you if you generate too many undeliverable emails. thus, if you just send a verification email without any pre-validation, it's pretty easy to get into a DoS situation where current/valid users don't get important email sent to them, or th…

> the major email providers will penalize you if you generate too many undeliverable emails. I suspect the rate at which new users may try to create new accounts and type a wrong email address is too low to be noticed by reputation metrics.

there's bad actors that use bots to sign up to websites using bogus data.

Re: Lies we tell ourselves about email addresses

#77

Post by paradox460 »

CPLX wrote: post #7
amiga386 wrote: post #3

Add the lie "emails are delivered instantly, so the user can click a link I email them within 1 minute" And the lie "users always read emails on the same device they're logging into a website with" And the lie "users can always view HTML email so no need to send a plaintext equivalent, especially if I have a long complex URL I want them to click" And the lie "Clickable links sent in email are more secure than passwor…

> Clickable links sent in email are more secure than passwords so I'll stop supporting passwords and instead rely on email delivery of a link for all logins God, I fucking hate that. I have a fucking password manager, I have various machines and things open. Just let me fucking log in. If anyone is reading this who is in charge of the internet please stop doing this.

I'll heap email and sms based otp into that

I have many ways to generate totp codes. All of them are vastly more convenient than sending me an email or sms

Re: Lies we tell ourselves about email addresses

#78

Post by dijit »

julian_t wrote: post #73

"Email addresses always have a 'normal' TLD" I registered a ".consulting" domain for my little company when they became available, and it has proved highly problematic ever since. Strangely (or perhaps not) it seems to be the larger players that have the most problems. I would at lest have expected ISPs and comms companies to keep up with this (looking at you, Three)

I once worked for a company that had a .company gTLD but not the .com

It was also a bloody nuisance. Spam filters were one thing but there were so many validation forms that failed.

Every reasonable variation of the company name as a .com/.net/.org was taken, including company.com

Ugh, what a nightmare.

Domain holders are the landed gentry of tomorrow if we keep this up.

Re: Lies we tell ourselves about email addresses

#79

Post by frereubu »

We have a UK client in the healthcare industry who registered the domain clientname.healthcare, and they rapidly found that the NHS imposed regexes which rejected name@clientname.healthcare emails.

Aside from regexes though, I also think the new TLDs confuse quite a lot of people. name@clientname.healthcare just doesn't click as an email address as quickly as name@clientname.com, and I'm in tech so I'm sure it's much more confusing for people outside that space.

In fact, that reminds me that we built a site for another client for use inside an exhibition space which was spacename.house and against our advice they put that - without www or https:// - on exhibition panels for use on mobile phones. I am absolutely convinced that most people didn't realise it was a web address.

Re: Lies we tell ourselves about email addresses

#80

Post by teo_zero »

AndroTux wrote: post #76
teo_zero wrote: post #58

Earlier quoted context omitted.

> the major email providers will penalize you if you generate too many undeliverable emails. I suspect the rate at which new users may try to create new accounts and type a wrong email address is too low to be noticed by reputation metrics.

there's bad actors that use bots to sign up to websites using bogus data.

Wait! Are you saying that you process new registration attempts without any rate limit, captcha, etc? Because the moment to filter out (or limit) bad actors is before they submit an email address, not through it.
Post reply on HN