Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It's Impossible to Validate an Email Address

elliot.land

Post reply on HN
Print view View original

41–50 of 68 posts

Re: It's Impossible to Validate an Email Address

#41

Post by ketralnis »

s_kilk wrote: post #36
mcv wrote: post #11

If you were to ask me for a regex, I'd say /.+@.+/. That's the easiest and most accurate way to do it by regex. Sure, some invalid addresses may still get accepted, but that is unavoidable. Even the most thorough validation[0] is going to accept nonexistent addresses. [0] Except those that validate by sending a mail to it. Sending an email is the only way to be sure.

> If you were to ask me for a regex, I'd say /.+@.+/ How about "one@two@three@four@example.com"?

Yes there are loads of invalid email addresses it allows. It's not supposed to be perfect.

Re: It's Impossible to Validate an Email Address

#42

Post by makecheck »

This advice should probably extend to a variety of form elements.

Like DRM and a lot of other efforts to “control” things, aggressive validators invariably punish people who are just trying to do legitimate things. Don’t piss off your real customers.

I used to live in a town with a 12-letter name, and more than once a form decided that it knew the Universal Sensible Maximum Length of Town Names and wouldn’t let me type the last couple characters. And it usually doesn’t stop there, because once a site is incapable of storing things sensibly it invariably starts to have trouble matching things, giving errors that are just plain stupid (e.g. “this other thing doesn’t match what you entered”, well no shit...).

There is also too much thought put into what constitutes a person’s “name”. Generally, to work across all possible cultures, use a single, very long text field that can contain whatever the person decides to type. After accepting their input as-is, feel free to internally perform parsing logic to try to allow additional database queries but under no circumstances should your page make any assumptions.

The real “you should be fired as database administrator” mistake though is to store modified data without telling the user. This usually happens with passwords; I use a site for months and then one day accidentally hit Return too soon and my password works anyway, meaning they just CLIPPED whatever strong password I entered and stored whatever they felt like (usually 8 characters). NEVER do things like that without telling the user.

Re: It's Impossible to Validate an Email Address

#43

Post by Freak_NL »

makecheck wrote: post #42

This advice should probably extend to a variety of form elements. Like DRM and a lot of other efforts to “control” things, aggressive validators invariably punish people who are just trying to do legitimate things. Don’t piss off your real customers. I used to live in a town with a 12-letter name, and more than once a form decided that it knew the Universal Sensible Maximum Length of Town Names and wouldn’t let me ty…

It is 2016. We should know better by now than to clip passwords at all. Sure, place a limit of 512 characters on it to prevent abuse, and for security reasons there can be a number of minimal requirements for length and complexity, but please let me be the one to decide if 32 characters is sensible or not.

Re: It's Impossible to Validate an Email Address

#44

Post by pbreit »

astrocat wrote: post #35
gaur wrote: post #19

What I'm about to say is more general than regex, but can online services please stop trying to validate my email address? If I gave you an email address that you think is invalid, rest assured I did it for a reason. I'm not an imbecile: I know how to type my address correctly (especially when you make me type it twice). For all the imbeciles who don't know how to type their address correctly, the phone system still…

I know it can be frustrating, it's happened to me too, but the reality is that email validation generally isn't for you . It's for the 99% of other people who would greatly appreciate the heads up that they've typed "something@yahoocom" or "Boys@MenFan1@whatever.com" and it's probably not what they meant to type. Now we can talk about HOW validation is implemented, and I think it would be completely fair to raise a w…

But it's extremely rare for a typo to result in an invalid email address, contrived examples notwithstanding.

Re: It's Impossible to Validate an Email Address

#45

Post by Freak_NL »

makecheck wrote: post #30
gaur wrote: post #19

What I'm about to say is more general than regex, but can online services please stop trying to validate my email address? If I gave you an email address that you think is invalid, rest assured I did it for a reason. I'm not an imbecile: I know how to type my address correctly (especially when you make me type it twice). For all the imbeciles who don't know how to type their address correctly, the phone system still…

Agreed. I find things like "youdont@needmyemail.com" usually work, and then if they ever bother to read what’s in their database they may get a hint.

kindlysodoff@mailinator.com is nice, and actually works for that one activation link you have to click.

Re: It's Impossible to Validate an Email Address

#46

Post by Freak_NL »

ketralnis wrote: post #41
s_kilk wrote: post #36

Earlier quoted context omitted.

> If you were to ask me for a regex, I'd say /.+@.+/ How about "one@two@three@four@example.com"?

Yes there are loads of invalid email addresses it allows. It's not supposed to be perfect.

Yeah, the point of checking for the @ is chiefly to prevent inexperienced users (e.g., elderly) from entering the wrong type of data. For example, enter a line from their postal address instead of their email address.

Re: It's Impossible to Validate an Email Address

#47

Post by kps »

educar wrote: post #3

> One more interesting tidbit is if you use unique sub-addresses for each of the sites you sign up to you will be able to see when someone, or rather who, sells your email to someone else... Busted! Can't the spammers simply strip the subaddress/label after '+' ?

No, they can't. Or rather, they can, but they'll be wrong. The ‘+’ is not a feature of email addresses; it doesn't mean anything different from any other character. It's just a feature of some destination systems that they ignore everything from ‘+’ when assigning incoming mail to accounts.

Generally, that's configurable; e.g. in postfix it's set by the optional |recipient_delimiter|. Suppose it's set to ‘-’, and you, John Public, sign up for SuspiciousService using the email address . Normally, the mail gets delivered to your 'john+public' mailbox. But if Mr Spammer strips everything from ‘+’, he sends to . And your system knows that that is not only not a valid local mailbox, but also that it matches a plus-stripped address, and therefore consigns the message and its sender to the fiery pits of hell.

Re: It's Impossible to Validate an Email Address

#48

Post by kps »

jukenim wrote: post #31

This checks whether or not an email address follows RFC 5322 via parsing vs via regex: https://github.com/jackbowman/email-addresses

Yes! The title is misleading; it's not at all difficult to syntactically validate an email address; it's just not possible using regular expressions (HE COMES).

Re: It's Impossible to Validate an Email Address

#49

Post by Spivak »

Kequc wrote: post #40

It seems there are weird things you can use in an email address that nobody does, as a result what is used and considered to be an email address has matured. If you create an email address that is weird, in practice you'll be less capable of using it. The weirder it is the fewer web forms or software you'll successfully put it into. I think we can just say no, functionally, you cannot put comments or additional @ sym…

> I shouldn't be expected to jump through the hoops necessary in order to allow "technically valid" email addresses that someone went out of their way to make, when I could more easily suggest they use a normal one.

I really hope you don't work on anything important if your stance is, "I shouldn't be expected to implement specifications correctly because it's easier to only implement part of it."

Why are we even having this discussion? Implement it correctly once, put it in a library and never worry about it again. You don't have to jump through any hoops, you're only making more work for yourself by implementing the standard incorrectly and then having to deal with customers that think that the ITEF standard is more valid than your personal definition of what an email address should be.

If your code is passed down the line and eventually hits someone who writes unit tests for actual valid email addresses then your name is going to come up on the git blame when it fails.

Re: It's Impossible to Validate an Email Address

#50

Post by noinsight »

Symbiote wrote: post #33
marcosdumay wrote: post #23

Earlier quoted context omitted.

It isn't a valid address. TLDs must not resolve, so it should be impossible to make a server handle it (yet, it is mostly possible, because most DNS servers do not completely implement the RFCs - still, there's no guarantee it will work on every network).

The first one I found that does resolve: http://ai./ It has an MX record too. There is nothing wrong with this.

Indeed - http://dk./ works too.
Post reply on HN