3 ms·

Loosely related. Why doesn't my web browser speak IMAP? If I could just enter my IMAP details into my browser settings, then it could silently IDLE on my Inbox,

Loosely related. Why doesn't my web browser speak IMAP? If I could just enter my IMAP details into my browser settings, then it could silently IDLE on my Inbox, and inform my currently open http://example.com/ http://example.com/ tabs when it receives email from an @example.com address. You'd need to stick it behind a "This website wishes to be notified about email you receive from it" prompt. But then you'd be able to do all sorts of clever stuff, including streamlining email validation checks and password resets. Everybody has email. You could create a "Login with Email" function really easily on your website, and it would work for even more users than the "Login with Facebook" option.

kodfodrasz 10y ago
why should the browsers speak every protocol? Why should everything be done through the browsers, instead of better specialized programs? Why should protocols designed for one problem be abused to solve other problems? Why not use client certs instead?
- mike-cardwell 10y ago
  "Why should the browsers speak every protocol?" Why should browsers only speak HTTP? Who made that rule? "Why should everything be done through the browsers, instead of better specialized programs?" I never said "everything". "Better specialised programs"? What are you talking about? I'm talking about essentially being able to access email from a webpage. There is no "better specialised program" for doing that. I'm not talking about webmail. I'm talking about automated emails. "Why should protocols designed for one problem be abused to solve other problems?" What you call "abuse", I call "use". "Why not use client certs instead?" This has nothing to do with anything I've mentioned.
  - kodfodrasz 10y ago
    No better program to access email from anywhere than a browser. Have you heard about MUA-s? Special mails should be used for authentication which would specially handled by the browser accessing your mailbox. This is abusing the mail protocols in my opinion. Certificate based auth does have something to with this: an existing, partially supported solution for auth with no magic needed and no need to reinvent the wheel, with hacks and extra complications.
    - mike-cardwell 10y ago
      "No better program to access email from anywhere than a browser. Have you heard about MUA-s?" You understand the difference between accessing email and reading email? I'm talking about JavaScript accessing email, and acting on it. You're talking about a human being reading a message. "Special mails should be used for authentication which would specially handled by the browser accessing your mailbox. This is abusing the mail protocols in my opinion." We're already sending registration emails and password reset links. We currently have a system where the end user has to read an email and click a link in it. My suggestion would just allow us to skip the human part and let the JavaScript read it directly, with a perfect fallback built in for people who don't have their browsers configured to have access to their mail. "Certificate based auth does have something to with this: an existing, partially supported solution for auth with no magic needed and no need to reinvent the wheel, with hacks and extra complications." Even with certificate based auth, you'd still end up having email involved with registration or password resets in some fashion.
      - kodfodrasz 10y ago
        You know, there is one thing I don't ever want to happen: to have JS running in my browser access to my emails and act upon that automatically. This has way too many security implications which don't make it a reasonable idea: 1. If sites can set up such action, then for that (I don't trust anybody's site to have any form of Access to my emails, except my mail providers per se), 2. if the browsers supply these actions, then for that cause (it would be exploited, or if it would be perfectly secure then it would also be perfectly useless).
        mike-cardwell 10y ago
        What security implications are there for a tab with the example.com origin to be able to read emails that you receive from an example.com email address? If it's behind a user access prompt, and the API requires that you specify the sender and recipient to monitor for? E.g: navigator.notifyOnEmail({ from: 'sender', to: 'recipientaddress', }, (email) => { /** * This callback is run whenever a new email * arrives from sender to recipientaddress. * Assuming the browser has access to the * recipientaddress account via IMAP, and * assuming the sender address matches the * browser origin and the user has given the * origin permission to do this. */ });

kodfodrasz 10y ago

why should the browsers speak every protocol? Why should everything be done through the browsers, instead of better specialized programs? Why should protocols designed for one problem be abused to solve other problems? Why not use client certs instead?

mike-cardwell 10y ago
"Why should the browsers speak every protocol?" Why should browsers only speak HTTP? Who made that rule? "Why should everything be done through the browsers, instead of better specialized programs?" I never said "everything". "Better specialised programs"? What are you talking about? I'm talking about essentially being able to access email from a webpage. There is no "better specialised program" for doing that. I'm not talking about webmail. I'm talking about automated emails. "Why should protocols designed for one problem be abused to solve other problems?" What you call "abuse", I call "use". "Why not use client certs instead?" This has nothing to do with anything I've mentioned.
- kodfodrasz 10y ago
  No better program to access email from anywhere than a browser. Have you heard about MUA-s? Special mails should be used for authentication which would specially handled by the browser accessing your mailbox. This is abusing the mail protocols in my opinion. Certificate based auth does have something to with this: an existing, partially supported solution for auth with no magic needed and no need to reinvent the wheel, with hacks and extra complications.
  - mike-cardwell 10y ago
    "No better program to access email from anywhere than a browser. Have you heard about MUA-s?" You understand the difference between accessing email and reading email? I'm talking about JavaScript accessing email, and acting on it. You're talking about a human being reading a message. "Special mails should be used for authentication which would specially handled by the browser accessing your mailbox. This is abusing the mail protocols in my opinion." We're already sending registration emails and password reset links. We currently have a system where the end user has to read an email and click a link in it. My suggestion would just allow us to skip the human part and let the JavaScript read it directly, with a perfect fallback built in for people who don't have their browsers configured to have access to their mail. "Certificate based auth does have something to with this: an existing, partially supported solution for auth with no magic needed and no need to reinvent the wheel, with hacks and extra complications." Even with certificate based auth, you'd still end up having email involved with registration or password resets in some fashion.
    - kodfodrasz 10y ago
      You know, there is one thing I don't ever want to happen: to have JS running in my browser access to my emails and act upon that automatically. This has way too many security implications which don't make it a reasonable idea: 1. If sites can set up such action, then for that (I don't trust anybody's site to have any form of Access to my emails, except my mail providers per se), 2. if the browsers supply these actions, then for that cause (it would be exploited, or if it would be perfectly secure then it would also be perfectly useless).
      - mike-cardwell 10y ago
        What security implications are there for a tab with the example.com origin to be able to read emails that you receive from an example.com email address? If it's behind a user access prompt, and the API requires that you specify the sender and recipient to monitor for? E.g: navigator.notifyOnEmail({ from: 'sender', to: 'recipientaddress', }, (email) => { /** * This callback is run whenever a new email * arrives from sender to recipientaddress. * Assuming the browser has access to the * recipientaddress account via IMAP, and * assuming the sender address matches the * browser origin and the user has given the * origin permission to do this. */ });