Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lies we tell ourselves about email addresses

gitpush--force.com

Post reply on HN
Print view View original

171–180 of 197 posts

Re: Lies we tell ourselves about email addresses

#171

Post by Dylan16807 »

greengreengrass wrote: post #117
atoav wrote: post #68

One thing I have learned about verification is: Don't just put a link into your mail that directly verifies an email when visited. At least put some button or code input field there. Why? There are mail clients that will automatically open links for users and if that link is now invalid the user is confused about being able to click them.

Or, even easier, just make the call idempotent. The user doesn’t know anything and doesn’t have extra clicks, and it doesn’t matter much if the mail client actually did the “confirming” given it’s proven the email address is valid at that point. The token was recently used? No problem! Must be a duplicate click, or a refresh, or the user left the browser tab open and their mobile device refreshed when they reopened t…

You don't send confirmation links just to prove the address is valid.

Re: Lies we tell ourselves about email addresses

#172

Post by gerdesj »

eythian wrote: post #141
cjs_ac wrote: post #86

Earlier quoted context omitted.

Bill Bryson claimed to have received a letter addressed to ‘Bill Bryson, Writer, Yorkshire’. I have some cousins who live in a small town in Australia where the houses have neither names nor numbers. You just address the envelope to ‘ , , ’, and it’s the postie’s responsibility to know where everyone lives. (‘Postie’ is the official job title in Australia Post because it’s gender-neutral.)

I lived in mildly rural NZ back in the day and it was the same, addresses were "name, street, RD# (rural delivery route number), town" and your mailbox had your name on the side (and a flag you could put up if you wanted mail collected.) Some time roughly mid-nineties we got numbers but originally they were just for emergency services, only later were they also for post, but I seem to recall the whole rural delivery…

It works for Wal and Cooch!

(I am a Brit and a massive fan of Footrot Flats)

Re: Lies we tell ourselves about email addresses

#173

Post by pseudohadamard »

FinnKuhn wrote: post #108
gerdesj wrote: post #13

Email is just like physical mail and thankfully just as endearingly human (sometimes). Once upon a time (1970/80s) I lived on and off in a mystic land called West Germany. Our postal addresses ended with incantations such as BFPO 40. Around 1985ish my granny send a Christmas card to us. I should note that she was at this time nearly seventy and sadly suffering from Parkinsons. She addressed the card, in rather crabbe…

When I was a child I sent a postcard to my grandparents. I forgot to put the house number and addressed the letter to "Oma und Opa" (Grandma and Grandpa). Logically it should not have been delivered successfully. Thankfully though, the postal worker knew my grandparents had grandchildren and therefore just asked the potential recipients for the name of their grandchildren to determine, which grandparents the postcard…

Up until at least the 1970s you could do this with smaller places in Germany. My mother has some old letters with addresses like "$surname, $village near $larger-village, West Germany". I assume it was routed to $larger-village, they passed it on to $village, and everyone there knows everyone else so the postie dropped it off the next day.

Re: Lies we tell ourselves about email addresses

#174

Post by pseudohadamard »

eythian wrote: post #141
cjs_ac wrote: post #86

Earlier quoted context omitted.

Bill Bryson claimed to have received a letter addressed to ‘Bill Bryson, Writer, Yorkshire’. I have some cousins who live in a small town in Australia where the houses have neither names nor numbers. You just address the envelope to ‘ , , ’, and it’s the postie’s responsibility to know where everyone lives. (‘Postie’ is the official job title in Australia Post because it’s gender-neutral.)

I lived in mildly rural NZ back in the day and it was the same, addresses were "name, street, RD# (rural delivery route number), town" and your mailbox had your name on the side (and a flag you could put up if you wanted mail collected.) Some time roughly mid-nineties we got numbers but originally they were just for emergency services, only later were they also for post, but I seem to recall the whole rural delivery…

RD addresses are still the same. Downside is you have to pay extra for rural delivery because the posties get danger money for avoiding the sheep-eating wetas.

Re: Lies we tell ourselves about email addresses

#175

Post by hdjrudni »

nvme0n1p1 wrote: post #36
8n4vidtmkvmk wrote: post #30

Earlier quoted context omitted.

I thought the same for a long time but now i don't know. If your computer is compromised, they can exfiltrate your password, but with a hardware key they can't, so i think that's legitimately more secure than password+otp. It still needs a pin though to protect against device theft. I bring this up because there's been a ton of compromised developer packages recently and windows itself is being attacked so even if yo…

If your computer is compromised, the attacker can just as easily read your email. OTP can be used with a password.

Uh huh? That's why I specifically said hardware key. Like a Yubikey. You can't digitally steal that.

Re: Lies we tell ourselves about email addresses

#176

Post by dredmorbius »

kgwxd wrote: post #123
greengreengrass wrote: post #119

I, too, get so frustrated by + addresses not working that I’ve configured my MDA to rewrite —- (double hyphen) to plus, and use this in spite on sites that dislike the + variant. I’ve made it impossible to /not/ host my own mail delivery infrastructure now if I want every address I’ve ever given out to still work. Although more recently I’ve moved to a catch all domain for throwaway, which is even better. It confuses…

> as {their company name}@mydomain.com People are still doing that? To prevent spam? To "catch" the company leaking/selling your address? Now the spammers know they can likely use anything@domain, and it'll get to your eyeballs in some capacity. Also, companies have no shame anymore, they don't care if you know.

The practice also makes filtering more effective.

Rather than whitelisting simply on a given sender, you can rely on both the sender and the recipient address matching a known list. This needn't be a single sender address. If you have multiple contacts at a domain, or a given entity relies on several email services (e.g., direct personal email, vendor-based marketing emails, vendor-based support or notification services), you could add all of these to the "from" match set.

I'm thinking through phone comms presently and am considering a similar concept for mitigating ever-growing phone abuse. Running a VOIP/PBX system, having multiple internal, non-public "extensions", each of which is valid for only a small subset of caller numbers. The "extension" space could be large (6--9 digits, say, millons to billions of values), making exhaustive search / coincidental match infeasible.

(This is only one of a few approaches I'm thinking of, it happens to resemble the specific email practice being discussed.)

Re: Lies we tell ourselves about email addresses

#177

Post by Joker_vD »

JdeBP wrote: post #100
Joker_vD wrote: post #57

Earlier quoted context omitted.

\.{1,100}@\.{1,100} I'd probably also have a red warning line under the input field for something really fishy and also most common typos (like "gmail.con") but other than that, I'd let it through.

Realistically, the length of the domain part is likely ultimately constrained by how large a domain name can fit into a DNS/UDP query packet (alongside EDNS0).

Realistically, people would need to go out of their way to have an e-mail with the domain part longer than a hundred ASCII characters (although considering Punycode, this limit perhaps should be more like 200, for CJK domains...) so if they do, well, it's their problem.

I just don't like the idea of allowing to paste 20 MiB-long text into the input field for what normally is a "short line of text", so there should be some upper limit.

Re: Lies we tell ourselves about email addresses

#178

Post by akimbostrawman »

hdjrudni wrote: post #175
nvme0n1p1 wrote: post #36

Earlier quoted context omitted.

If your computer is compromised, the attacker can just as easily read your email. OTP can be used with a password.

Uh huh? That's why I specifically said hardware key. Like a Yubikey. You can't digitally steal that.

That doesn't address anything. If your device is compromised they do not need your hardware key because they can just read all mails on device or steal login/session cookies for accounts and bypass authentication.

Passkey is still inferior to U2F + password anyways.

Re: Lies we tell ourselves about email addresses

#179

Post by JdeBP »

Joker_vD wrote: post #177
JdeBP wrote: post #100

Earlier quoted context omitted.

Realistically, the length of the domain part is likely ultimately constrained by how large a domain name can fit into a DNS/UDP query packet (alongside EDNS0).

Realistically, people would need to go out of their way to have an e-mail with the domain part longer than a hundred ASCII characters (although considering Punycode, this limit perhaps should be more like 200, for CJK domains...) so if they do, well, it's their problem. I just don't like the idea of allowing to paste 20 MiB-long text into the input field for what normally is a "short line of text", so there should be…

Yes there should, and the maximum size of what fits into a 512-octet DNS/UDP query packet, less header and EDNS0 and whatnot, is going to be that limit, ultimately. Because SMTP-based Internet MTSes that do not look up MX resource record sets in the DNS, and do not begin at DNS/UDP, do not currently exist. (-:

Even if they magically all switched to starting at DNS/TCP, that is still only 64KiB less header and EDNS0 and whatnot. And in that case one also has to allow space for sending the actual resource record set back in the response, DNS/TCP not having DNS/UDP's luxury of truncation, so it's not even as large as that.

Re: Lies we tell ourselves about email addresses

#180

Post by naishoya »

forgetfreeman wrote: post #115

"Regex is hard, regex wizardry is rare, and regex engine implementations are inconsistent. It’s very, very easy to accidentally get it wrong without realizing it." The what now? I'm struggling to take this seriously because a decade ago regex where common knowledge, like if you don't have a handle on this you should probably go get a job in marketing levels of common knowledge. Has the profession fallen off this far…

Sad truth: Yes.

Yes, it has fallen off this far in the last ten years.

If you look a little further back, say to 2006-ish it's far worse than that.

Back then there were 'bright' middle-school ROV team members writing C and Ada+Spark for Arduino-board control-by-wire small craft to perform simulated ocean sample collection and tool manipulation tasks and winning in the unlimited class against university competition at international championships.

Now the "Profession" consists of teams using ChatGPT to cheat on basic coding tasks and "make nudify" of famous people from their work machines.

Post reply on HN