5 ms·

TL;DR the odds that the user entered an incorrect-but-valid address are way higher than that they entered one which will not actually be able to receive mail. S

by amk_ 10y ago

TL;DR the odds that the user entered an incorrect-but-valid address are way higher than that they entered one which will not actually be able to receive mail. Send a validation email.

tempestn 10y ago
Also relevant was, "If you have a well laid-out form with a label that says “email”, and the user enters an ‘@’ symbol somewhere, then it’s safe to say they understood that they were supposed to be entering an email address." In other words, it does make sense to check that they entered an '@' symbol somewhere, since it shows that they understood it was an email field. Any 'validation' beyond that is useless.
- danso 10y ago
  How about more than one @ sign? Does the email address spec exclude the possibility of more than one @ symbols?
  - kej 10y ago
    Nope, that's valid if one of them is quoted: "very.unusual.@.unusual.com"@example.com
  - deleted 10y ago
    [deleted]
  - tempestn 10y ago
    It doesn't matter. If they have typed an @, they probably understand that it's an email field. Trying to validate to the spec beyond that is pointless, for reasons thoroughly covered in the article.
  - zeveb 10y ago
    The local-part may contain a quoted @: "@"@example.invalid is a valid email address. @ signs are also permitted in comments: (ted@home)ted@example.invalid is also a valid email address.
  - ediblenergy 10y ago
    It actually used to (maybe still does) signal routing information[1]. An example from the RFC is "@ONE,@TWO:JOE@THREE" [1]: https://tools.ietf.org/html/rfc821 https://tools.ietf.org/html/rfc821
pbreit 10y ago
Address validation by sending an email should only be used if it is required for some reason to verify the user owns the email account. Otherwise, it's not a great UX.
- gregmac 10y ago
  I honestly can't think of a reason you'd ask a user for their email but not need to validate it. For being able to do password resets later, permission to add to mailing list, avoiding sending private info to the wrong user, avoiding allowing someone to masquerading or impersonate someone they're not.. All should be validated. If you're looking for a username as login identity and nothing more (and you don't have password reset functionality), then ask for a 'username', not email addresses.
  - vacri 10y ago
    email addresses for usernames have the advantage of already being unique. None of this "gregmac already taken, try gregmac23, gregmc_595, or verbingnounXX instead?" nonsense
    - zAy0LfpBZLC8mAC 10y ago
      > email addresses for usernames have the advantage of already being unique Not true. There are people who share an email address.
      - niij 10y ago
        Care to expand? As in having a first.last@example versus firstlast@example
        mabcat 10y ago
        As in bloggsfamily@localisp.net.au that both parents and all the younger sprogs share. Still common as anything.
wyldfire 10y ago
For flip's sake, yes please! Close the loop, fer crying out loud. I got a popular givenname.familyname@gmail.com address and I frequently get mail that's meant for other people who share my name. The vast majority of the time it's the individual themselves who sign up for a service or offering but there's rarely a validation upfront. The best emails are the ones who extend full trust to the email recipient over some account during that first email. Facebook, shame on you.
- lucb1e 10y ago
  > The best emails are the ones who extend full trust to the email recipient over some account during that first email. [Random company,] shame on you. Well what else would you have them do? Have people enter their address and send letters there to do a password reset? A confirmation email before full trust is going to do little: a malicious person would just click that link, right?
  - wyldfire 10y ago
    Someone could have just created an account and accidentally put the wrong email address in. Therefore, putting a link that extends full trust in the welcome/confirmation email is a design error. The fix for this error is to require the newly created account holder to put in their password on this first login. While the account's in this state it shouldn't be possible to reset the password.
  - deleted 10y ago
    [deleted]
- CRConrad 10y ago
  Mine is firstinitialmiddleinitialfamilyname. There are an amazing number of C. R. Conrad's in the world -- mostly the USA -- who seem to think they own that address.
CRConrad 10y ago
Yup,waaay higher. And when they do, it's usually mine.

by amk_ 10y ago

TL;DR the odds that the user entered an incorrect-but-valid address are way higher than that they entered one which will not actually be able to receive mail. Send a validation email.

tempestn 10y ago

Also relevant was, "If you have a well laid-out form with a label that says “email”, and the user enters an ‘@’ symbol somewhere, then it’s safe to say they understood that they were supposed to be entering an email address." In other words, it does make sense to check that they entered an '@' symbol somewhere, since it shows that they understood it was an email field. Any 'validation' beyond that is useless.

danso 10y ago
How about more than one @ sign? Does the email address spec exclude the possibility of more than one @ symbols?
- kej 10y ago
  Nope, that's valid if one of them is quoted: "very.unusual.@.unusual.com"@example.com
- deleted 10y ago
  [deleted]
- tempestn 10y ago
  It doesn't matter. If they have typed an @, they probably understand that it's an email field. Trying to validate to the spec beyond that is pointless, for reasons thoroughly covered in the article.
- zeveb 10y ago
  The local-part may contain a quoted @: "@"@example.invalid is a valid email address. @ signs are also permitted in comments: (ted@home)ted@example.invalid is also a valid email address.
- ediblenergy 10y ago
  It actually used to (maybe still does) signal routing information[1]. An example from the RFC is "@ONE,@TWO:JOE@THREE" [1]: https://tools.ietf.org/html/rfc821 https://tools.ietf.org/html/rfc821

pbreit 10y ago

Address validation by sending an email should only be used if it is required for some reason to verify the user owns the email account. Otherwise, it's not a great UX.

gregmac 10y ago
I honestly can't think of a reason you'd ask a user for their email but not need to validate it. For being able to do password resets later, permission to add to mailing list, avoiding sending private info to the wrong user, avoiding allowing someone to masquerading or impersonate someone they're not.. All should be validated. If you're looking for a username as login identity and nothing more (and you don't have password reset functionality), then ask for a 'username', not email addresses.
- vacri 10y ago
  email addresses for usernames have the advantage of already being unique. None of this "gregmac already taken, try gregmac23, gregmc_595, or verbingnounXX instead?" nonsense
  - zAy0LfpBZLC8mAC 10y ago
    > email addresses for usernames have the advantage of already being unique Not true. There are people who share an email address.
    - niij 10y ago
      Care to expand? As in having a first.last@example versus firstlast@example
      - mabcat 10y ago
        As in bloggsfamily@localisp.net.au that both parents and all the younger sprogs share. Still common as anything.

wyldfire 10y ago

For flip's sake, yes please! Close the loop, fer crying out loud. I got a popular givenname.familyname@gmail.com address and I frequently get mail that's meant for other people who share my name. The vast majority of the time it's the individual themselves who sign up for a service or offering but there's rarely a validation upfront. The best emails are the ones who extend full trust to the email recipient over some account during that first email. Facebook, shame on you.

lucb1e 10y ago
> The best emails are the ones who extend full trust to the email recipient over some account during that first email. [Random company,] shame on you. Well what else would you have them do? Have people enter their address and send letters there to do a password reset? A confirmation email before full trust is going to do little: a malicious person would just click that link, right?
- wyldfire 10y ago
  Someone could have just created an account and accidentally put the wrong email address in. Therefore, putting a link that extends full trust in the welcome/confirmation email is a design error. The fix for this error is to require the newly created account holder to put in their password on this first login. While the account's in this state it shouldn't be possible to reset the password.
- deleted 10y ago
  [deleted]
CRConrad 10y ago
Mine is firstinitialmiddleinitialfamilyname. There are an amazing number of C. R. Conrad's in the world -- mostly the USA -- who seem to think they own that address.

CRConrad 10y ago

Yup,waaay higher. And when they do, it's usually mine.