Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Email address validation: please stop

blog.sinjakli.co.uk

Post reply on HN
Print view View original

71–80 of 86 posts

Re: Email address validation: please stop

#71

Post by frobozz »

soulclap wrote: post #67
frobozz wrote: post #61

Earlier quoted context omitted.

Hope is all you have, if email is the black box wilderness you describe. You rely on hope regardless of whether or not your email address contains "super-special characters". My whole point is that there is a standard for an email address, outlined in a freely-available document. If an application claims to handle email, that claim implies conformance to that standard. Any deviation should be documented. Your claim a…

Your view of this whole subject seems to be completely upside down. There's no such thing as a 100% guarantee when it comes to email (Interwebs 101) but it should be completely obvious to any sane person that you are getting much closer to those 100% if you don't use any "super-special characters" in your e-mail address as opposed to people "asking for it" by using an address like {^|~!}@gmail.com - which will obviou…

1) Regarding the kinds of mailbox names an email provider will provide you with, it's up to the provider. My employer, for example, only lets us have firstname.surname, With the addition of a single digit in case more than one employee has that name. These limitations have nothing to do with standards compliance.

2) Gmail does allow you to send mail to non-legit, but standards-compliant addresses like {^|~!}@example.com, because they know that their own mailbox name rules don't extend to other providers.

Regarding your point b) evidently they're not smart enough to grasp that addresses with + in them only work on the theoretical internet, and not the real one.

Re: Email address validation: please stop

#72

Post by thirsteh »

pbhjpbhj wrote: post #31
thirsteh wrote: post #7

Here's an example of RFC 2822 using RegEx in case HackerNews comments filter out some of the symbols: http://bit.ly/g1uFMz

I note that you apparently put the source for the regex in there - http://tools.ietf.org/html/rfc2822 ?

That's the RFC it follows, yes. I found out about the regex here: http://www.regular-expressions.info/email.html

The author does say you shouldn't use it -- it's a crazy regular expression after all -- but it IS the RFC :D

Re: Email address validation: please stop

#73

Post by muitocomplicado »

T-hawk wrote: post #69
furyg3 wrote: post #15

The "+" feature of gmail is great, but I hesitate to use it after some weird validation problems I've had. I've stopped asking that people validate properly, and started hoping that they a) don't validate or b) fail gracefully. One (very important) site properly validated my "+" email address on the front end (gave me no errors), but the backend failed and I never received the required confirmation email... all resul…

Shouldn't the spammers have figured out the "+" feature by now? Just remove it and the suffix to get a valid address, for gmail or any other provider that uses the syntax. return Regex.replace(email, "([^\+])°[^@]°(@.°)$", "$1$2") ° should be * but HN eats it as markup.

I don't see this feature as a way to fight spam, but to make it easier to label incoming mail by using the sufixes. As you said, it's easy to bypass it with some simple find and replace.

Re: Email address validation: please stop

#74

Post by muitocomplicado »

retube wrote: post #17
eli wrote: post #12

Earlier quoted context omitted.

If you want your site to have a "login as guest" type feature that's one thing, but if an email address doesn't have an @ it will never work and it would be misleading to encourage people to check their email for a validation link. People sometimes misread labels and enter their name on the line for their address. This would stop that.

Yeah exactly. It's more to catch wrong stuff entered in wrong field.

I had people write www.hotmail.com in the email field in the past.

Re: Email address validation: please stop

#75

Post by ChuckMcM »

"If you want to know that you’re being given a valid address, send it an email and have the user click a validation link in it, and stop annoying your users!"

Epic fail. Its this sort of approach that ends up resulting in cross site scripting bugs. Oh just take what ever the user typed in, and send it to the server they told me to send it to. Boom!

The perl code is perfectly reasonable for validating RFC compliant addresses.

Re: Email address validation: please stop

#76

Post by ChuckMcM »

perlgeek wrote: post #24

Please stop... to collect email addresses you don't really need. When I participate in some kind of online community, I want to chose if I receive emails from them at all. And if not, it should be my choice if I provide any email address at all. I have a small site where you can participate anonymously or log in, and when you create an account it's your choice if you provide an email address at all. If not, and you l…

True, although I'm a fan of 'tiered' services since robots (spammers, trolls, and others) also participate, I'd like a way of saying "this is a real person".

If you're looking for a startup idea how about a service that creates an anonymous ID (to me anyway) where the user provides that id to me, I send it to a service and get back a 'reputation' bit which says if you're a good guy or a bad guy (person what ever). And a way to report you've not been co-operating so that others can benefit.

Ebay reputation model but nominally anonymous. (at some point in some server somewhere there will be a way to link token a to token b but I'm totally ok if it can't be resolved into an actual person.)

Re: Email address validation: please stop

#77

Post by JoachimSchipper »

DevX101 wrote: post #33

While we're on the topic of emails, does anyone have any anecdotes or data on how often users will click activation links if I log them in after registration? I always hated having to log in to my email after signing up, so I just create an account and login users without any upfront verification. My email to the user says I will disable accounts that are not activated in 4 days, but its just a bluff :)

Be careful about that - if you keep mailing them without requiring a confirmation, people will scream about "double opt-in" and put your mailserver on various blacklists. (A nastier sort will use your service to flood the mailboxes of people they don't like with your messages, hence the spamfighters' response.)

Re: Email address validation: please stop

#78

Post by JoachimSchipper »

aneth wrote: post #38

I never understood the point of enforcing the spec for user input. Even if done properly it may reject some working, but invalid email addresses. And it does nothing to increase your chances of getting a good email address. Your user is either willing to give you their real address or not. If they are willing, validating fully does not protect against typos and if they are not you will get a well formattd fake addres…

Some really broken/misconfigured mailer software may still accept the 'foo@bar@qux' syntax (route mail for user foo@bar via qux, or the other way round - I forgot which, since no sane system has implemented this since the word 'spam' came to mean bad e-mail.)

So there may, theoretically, be some value in checking for the presence of exactly one @.

Re: Email address validation: please stop

#80

Post by soulclap »

frobozz wrote: post #71
soulclap wrote: post #67

Earlier quoted context omitted.

Your view of this whole subject seems to be completely upside down. There's no such thing as a 100% guarantee when it comes to email (Interwebs 101) but it should be completely obvious to any sane person that you are getting much closer to those 100% if you don't use any "super-special characters" in your e-mail address as opposed to people "asking for it" by using an address like {^|~!}@gmail.com - which will obviou…

1) Regarding the kinds of mailbox names an email provider will provide you with, it's up to the provider. My employer, for example, only lets us have firstname.surname, With the addition of a single digit in case more than one employee has that name. These limitations have nothing to do with standards compliance. 2) Gmail does allow you to send mail to non-legit, but standards-compliant addresses like {^|~!}@example.…

You are talking about naming conventions, that's something completely different. GMail does not enforce any 'firstname.lastname' patterns.
Post reply on HN