Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lies we tell ourselves about email addresses

gitpush--force.com

Post reply on HN
Print view View original

31–40 of 197 posts

Re: Lies we tell ourselves about email addresses

#31

Post by thwarted »

jeffbee wrote: post #8

This article says that Gmail can't handle address literals. I personally wrote the IPv6 address literal support for Gmail, so this annoys me. I just tested it and it shortened "[IPv6:2001:etc:etc::192.etc.etc]" down to "@2001" then generated an extremely terse mail delivery subsystem notification that I've never seen before. Which is why you should never just rewrite software without understanding why all the test ca…

> "[IPv6:2001:etc:etc::192.etc.etc]"

I'm trusting this is a throwaway example and that you used a real IPv6 address literal in this test, without the "IPv6" and with only colons and no dots (unless you mean to use v4 mapped address with dots)? Because this IPv6 literal is so malformed that I'm hardly expecting it to do something sane and changing that to "@2001" is nasal-demons quality undefined behavior. I tried with this exact literal and it let me send it but then there was a tiny red pop-up at the top of the gmail interface that said "could not be delivered, check your network connection" (which is odd; the same kind of pop-up that appears in gray when you legitimately are not connected to the internet) and it ended up in my drafts with the To: field empty.

I just tried to send a message to a "test@[" my current IPv6 address "]", and gmail told me

    Error
    The address "test@[«redacted»]" in the "To" field was not recognized.
    Please make sure that all addresses are properly formed.
This address doesn't have an MDA listening on it, but it didn't accept it enough to give me a non-delivery notification, it didn't even let me send it. gmail did accept an IPv4 address literal in brackets, although it hasn't given me back a non-delivery notification. What it stuffed into my Sent folder for this message has the square brackets stripped and the IPv4 address appears right after the @.

Re: Lies we tell ourselves about email addresses

#32

Post by 8n4vidtmkvmk »

gerdesj wrote: post #13

Email is just like physical mail and thankfully just as endearingly human (sometimes). Once upon a time (1970/80s) I lived on and off in a mystic land called West Germany. Our postal addresses ended with incantations such as BFPO 40. Around 1985ish my granny send a Christmas card to us. I should note that she was at this time nearly seventy and sadly suffering from Parkinsons. She addressed the card, in rather crabbe…

New rule: when emailing someone, you need to include their name. If you do that, the email delivery gods will correct typos in your email address.

Re: Lies we tell ourselves about email addresses

#33

Post by denkmoon »

readthenotes1 wrote: post #15
denkmoon wrote: post #9

Earlier quoted context omitted.

The people in charge of the internet are "cybersecurity" "professionals" who can't even follow NIST guidance.

The "change your password every 6 months" guidance?

Specifically the revocation of such guidance. If the field gave even the slightest deference to empiricism we wouldn't be changing our password every 180 days, but here we are.

Re: Lies we tell ourselves about email addresses

#34

Post by jiveturkey »

trumpdong wrote: post #22
jiveturkey wrote: post #19

> TL;DR: Don't overthink it, just send a verification email. pretty bad advice, if taken only as written, without adding more flavor on top. the major email providers will penalize you if you generate too many undeliverable emails. thus, if you just send a verification email without any pre-validation, it's pretty easy to get into a DoS situation where current/valid users don't get important email sent to them, or th…

I think the only way to deal with that right now is to hire a company whose job is to deal with it. They'll random-check your outgoing emails are indeed what you say they are, and they maintain a reputation with the big providers for checking it properly. What pre-validation could you do that would possibly be useful?

entropy check, for one

Re: Lies we tell ourselves about email addresses

#35

Post by denkmoon »

Kaliboy wrote: post #29
denkmoon wrote: post #9

Earlier quoted context omitted.

The people in charge of the internet are "cybersecurity" "professionals" who can't even follow NIST guidance.

It is with much hesitation that I write this, because I just implemented such a flow. My reasoning was this: my customers keep forgetting their password and somehow that becomes a trigger to contact me. No passwords, no problem. I tried convincing them to use password managers but that was pointless. But I see the pain and frustration so I will add passwords. And I quite liked the passkey idea, have to see how that w…

To be clear, no shade on actual devs faced with actual problems. My ire is reserved exclusively for the "we must do this because it is on the checklist, no I don't understand what a subnet is" people.

Re: Lies we tell ourselves about email addresses

#36

Post by nvme0n1p1 »

8n4vidtmkvmk wrote: post #30
anon7000 wrote: post #23

Earlier quoted context omitted.

So agreed. It’s fucking crazy. Password manager is so much easier and more secure. If you do this dumb email or SMS OTP flow, at LEAST support passkeys for my password manager! It’s wild that they’re like “it’s more secure to not have a password” and then choose two unencrypted delivery mechanisms for the very short OTP. Sure, people who reuse passwords are not secure. And fair, I guess it’s a tragedy of the commons.…

I thought the same for a long time but now i don't know. If your computer is compromised, they can exfiltrate your password, but with a hardware key they can't, so i think that's legitimately more secure than password+otp. It still needs a pin though to protect against device theft. I bring this up because there's been a ton of compromised developer packages recently and windows itself is being attacked so even if yo…

If your computer is compromised, the attacker can just as easily read your email.

OTP can be used with a password.

Re: Lies we tell ourselves about email addresses

#37

Post by Terr_ »

amiga386 wrote: post #3

Add the lie "emails are delivered instantly, so the user can click a link I email them within 1 minute" And the lie "users always read emails on the same device they're logging into a website with" And the lie "users can always view HTML email so no need to send a plaintext equivalent, especially if I have a long complex URL I want them to click" And the lie "Clickable links sent in email are more secure than passwor…

> And the lie "users always read emails on the same device they're logging into a website with"

Or the same browser, or the same browser-profile. For example, on my phone I have external links (from other apps) opening in incognito mode by default.

Re: Lies we tell ourselves about email addresses

#38

Post by Terr_ »

CPLX wrote: post #7
amiga386 wrote: post #3

Add the lie "emails are delivered instantly, so the user can click a link I email them within 1 minute" And the lie "users always read emails on the same device they're logging into a website with" And the lie "users can always view HTML email so no need to send a plaintext equivalent, especially if I have a long complex URL I want them to click" And the lie "Clickable links sent in email are more secure than passwor…

> Clickable links sent in email are more secure than passwords so I'll stop supporting passwords and instead rely on email delivery of a link for all logins God, I fucking hate that. I have a fucking password manager, I have various machines and things open. Just let me fucking log in. If anyone is reading this who is in charge of the internet please stop doing this.

There's a landlord/apartment portal where the whole login process has changed to be:

1. Enter username (e.g. an email)

2. Choose from either email or SMS on file

3. Enter the code you got somehow through the respective unencrypted channel

Given that this same site is involved with bank-account details for payment, I am concerned...

Re: Lies we tell ourselves about email addresses

#39

Post by butvacuum »

amiga386 wrote: post #3

Add the lie "emails are delivered instantly, so the user can click a link I email them within 1 minute" And the lie "users always read emails on the same device they're logging into a website with" And the lie "users can always view HTML email so no need to send a plaintext equivalent, especially if I have a long complex URL I want them to click" And the lie "Clickable links sent in email are more secure than passwor…

I don't think it's about security. It's about fobing off password resets on somebody else.

Re: Lies we tell ourselves about email addresses

#40

Post by butvacuum »

Kaliboy wrote: post #29
denkmoon wrote: post #9

Earlier quoted context omitted.

The people in charge of the internet are "cybersecurity" "professionals" who can't even follow NIST guidance.

It is with much hesitation that I write this, because I just implemented such a flow. My reasoning was this: my customers keep forgetting their password and somehow that becomes a trigger to contact me. No passwords, no problem. I tried convincing them to use password managers but that was pointless. But I see the pain and frustration so I will add passwords. And I quite liked the passkey idea, have to see how that w…

Good to see my take verified. But, where does the buck stop? What if your phone relies on email, but your email needs your phone.
Post reply on HN