4 ms·

I wonder if all the critical commenters here feel the same about sites sending a verification e-mail before completing your registration. After all, it serves t

I wonder if all the critical commenters here feel the same about sites sending a verification e-mail before completing your registration. After all, it serves the same purpose of preventing usage of bogus e-mail addresses. If you're against this kind of library, I suppose you shouldn't bother with verifying e-mail addresses either.

caf 11y ago
Verification emails serve the purpose of ensuring that people don't sign up other people's email addresses.
- imglorp 11y ago
  And if they do, why is that bad?
  - vidarh 11y ago
    Because it makes signing people up to all kinds of things they don't want to be signed up to trivial. If you are actually going to use the address given, it makes sense to verify it to prevent abuse. Not least because you risk having your ability to deliver e-mail severely jeopardised by abuse if you don't.
  - pdkl95 11y ago
    Because of the script that destroys email addresses by signing them up for 5000 mailing lists.
    - no1youknowz 11y ago
      What script is that? Never heard of such a thing.
      - pdkl95 11y ago
        There were several going around in the "warez" scene in the mid-90s. It didn't require a script, either. When mailing lists and other automatic email sources let you add destination addresses without closing the confirmation loop by sending a test email, you can denial-of-service email addresses with just an SMTP client. The really nasty part about this attack is that it's not just bandwidth amplification. Normal amplification attacks go away when the attacker decides to stop sending packets. With mailing subscriptions, the badly-configured mailing lists keep sending the attack on their own.
  - gus_massa 11y ago
    People can create fake accounts with other person email. For example, a last year case of a fake account for Linus Torvalds in change.org https://plus.google.com/+LinusTorvalds/posts/DPY7H4a9Ma5 https://plus.google.com/+LinusTorvalds/posts/DPY7H4a9Ma5 > Somebody signed a Change.Org petition in my name, and using a really old email address of mine. > So since I apparently had an "account", I reset the password, and made a petition of my own. > Change.Org - please change your dickish ways. Ok?
callesgg 11y ago
There is a difference in detecting if someone actually owns an email address and detecting if an email address is the persons primary email address.

caf 11y ago

Verification emails serve the purpose of ensuring that people don't sign up other people's email addresses.

imglorp 11y ago
And if they do, why is that bad?
- vidarh 11y ago
  Because it makes signing people up to all kinds of things they don't want to be signed up to trivial. If you are actually going to use the address given, it makes sense to verify it to prevent abuse. Not least because you risk having your ability to deliver e-mail severely jeopardised by abuse if you don't.
- pdkl95 11y ago
  Because of the script that destroys email addresses by signing them up for 5000 mailing lists.
  - no1youknowz 11y ago
    What script is that? Never heard of such a thing.
    - pdkl95 11y ago
      There were several going around in the "warez" scene in the mid-90s. It didn't require a script, either. When mailing lists and other automatic email sources let you add destination addresses without closing the confirmation loop by sending a test email, you can denial-of-service email addresses with just an SMTP client. The really nasty part about this attack is that it's not just bandwidth amplification. Normal amplification attacks go away when the attacker decides to stop sending packets. With mailing subscriptions, the badly-configured mailing lists keep sending the attack on their own.
- gus_massa 11y ago
  People can create fake accounts with other person email. For example, a last year case of a fake account for Linus Torvalds in change.org https://plus.google.com/+LinusTorvalds/posts/DPY7H4a9Ma5 https://plus.google.com/+LinusTorvalds/posts/DPY7H4a9Ma5 > Somebody signed a Change.Org petition in my name, and using a really old email address of mine. > So since I apparently had an "account", I reset the password, and made a petition of my own. > Change.Org - please change your dickish ways. Ok?

callesgg 11y ago

There is a difference in detecting if someone actually owns an email address and detecting if an email address is the persons primary email address.