4 ms·

Why can't it be both sides' issue? I have a fairly uncommon first and last name, but I still get emails from the few folk who share my name combination, and I t

by csydas 9y ago

Why can't it be both sides' issue? I have a fairly uncommon first and last name, but I still get emails from the few folk who share my name combination, and I too have gotten sensitive information that I shouldn't have. I cannot imagine the strangeness that must occur for folks with more common name combinations, and the idea that e.mail@gmail.com is the same as email@gmail.com just seems wrong to me. As far as I know, all other email services and providers treat such accounts as unique, and it's a strange situation with very limited benefit to the end user. While I have made use of "the dots don't matter", it's always been as a way of circumventing account restrictions. The casual convenience of "dots not mattering" seems like it's overshadowed by the difficulty this can cause (as evidenced with the article and my own experience)

djur 9y ago
Permitting separate "sarah.jones" and "sarahjones" accounts would be pretty bad, too. Too easy to impersonate people. "Dots matter but are not included in uniqueness checks" is probably the safest approach.
- shkkmo 9y ago
  While you CAN strip periods in the local part of the email and convert them to lower case before checking uniqueness, you do this as the risk of improperly disallowing valid and distinct addresses. A better solution is to check for similar address and provide a prompt "do you already have an account with this address:" rather than completely blocking registration with that address. However, you should definitely not do these things to the address that you save for the purposes of sending email because then you risk improperly sending emails to the wrong person. In general, validating the format of an email address is both extremely hard and pointless (since only a small portion of mis-entries will results in an invalid email address). Pretty much the only way to validate an email address effectively is to verify it by sending an email to it and expecting the user to click an email.
  - djur 9y ago
    To be clear, I'm talking about what email providers could do to reduce the risk of confusion, not what email senders should do to validate emails. I agree that the only way to validate an email address is to send a confirmation.
    - shkkmo 9y ago
      Except it does little to nothing to reduce confusion. It does nothing to fix the problem of people signing up using an email with a typo or with an email that doesn't actually belong to them. This on service providers to implement secure access properly.
      - djur 9y ago
        I'm not thinking primarily of transactional emails here. If Gmail allowed dots and allowed registering both "jane.smith" and "janesmith", Jane Smith would be well-advised to register both, because it's going to be the most common mistake people make. It's the same principle that suggests that if you own a .org address you should probably go ahead and buy the .com, too.
  - coredog64 9y ago
    Gmail is a fairly common mail host. Doing what you suggest for ‘@gmail.com’ addresses would be an easy solution. You could also make the case that Google should have a free library for most common languages that does this for you. It would improve the safety of their users immensely. I may, however, be somewhat biased as I am the frequent recipient of email from weird services that some other chucklehead keeps signing up for even though he has yet to get past email verification as he doesn’t own the address.
    - shkkmo 9y ago
      > You could also make the case that Google should have a free library for most common languages that does this for you. It would improve the safety of their users immensely. Please don't. I don't want an official library to exist to facilitate people harvesting and selling my email address without me knowing the source of the leak. > I may, however, be somewhat biased as I am the frequent recipient of email from weird services that some other chucklehead keeps signing up for even though he has yet to get past email verification as he doesn’t own the address. And you have existing accounts with all of these services? Or how does this relate to service providers striping dots when checking uniqueness? You should report those emails as spam. If you never verified the email address they have no right to continue to send emails to you.
shkkmo 9y ago
> Why can't it be both sides' issue? Even if Google didn't provide this feature to their users (and it is a feature that I regularly use to track who leaks my email address and then auto block emails to that address), Netflix's approach of sending sensitive emails without verifying the email address is still prone to security problems. Many people have multiple email accounts, or aren't really aware which email account they used to sign up. Sending a "please update your billing info" without verifying the email account first is purely on Netflix.

by csydas 9y ago

djur 9y ago

Permitting separate "sarah.jones" and "sarahjones" accounts would be pretty bad, too. Too easy to impersonate people. "Dots matter but are not included in uniqueness checks" is probably the safest approach.

shkkmo 9y ago
While you CAN strip periods in the local part of the email and convert them to lower case before checking uniqueness, you do this as the risk of improperly disallowing valid and distinct addresses. A better solution is to check for similar address and provide a prompt "do you already have an account with this address:" rather than completely blocking registration with that address. However, you should definitely not do these things to the address that you save for the purposes of sending email because then you risk improperly sending emails to the wrong person. In general, validating the format of an email address is both extremely hard and pointless (since only a small portion of mis-entries will results in an invalid email address). Pretty much the only way to validate an email address effectively is to verify it by sending an email to it and expecting the user to click an email.
- djur 9y ago
  To be clear, I'm talking about what email providers could do to reduce the risk of confusion, not what email senders should do to validate emails. I agree that the only way to validate an email address is to send a confirmation.
  - shkkmo 9y ago
    Except it does little to nothing to reduce confusion. It does nothing to fix the problem of people signing up using an email with a typo or with an email that doesn't actually belong to them. This on service providers to implement secure access properly.
    - djur 9y ago
      I'm not thinking primarily of transactional emails here. If Gmail allowed dots and allowed registering both "jane.smith" and "janesmith", Jane Smith would be well-advised to register both, because it's going to be the most common mistake people make. It's the same principle that suggests that if you own a .org address you should probably go ahead and buy the .com, too.
- coredog64 9y ago
  Gmail is a fairly common mail host. Doing what you suggest for ‘@gmail.com’ addresses would be an easy solution. You could also make the case that Google should have a free library for most common languages that does this for you. It would improve the safety of their users immensely. I may, however, be somewhat biased as I am the frequent recipient of email from weird services that some other chucklehead keeps signing up for even though he has yet to get past email verification as he doesn’t own the address.
  - shkkmo 9y ago
    > You could also make the case that Google should have a free library for most common languages that does this for you. It would improve the safety of their users immensely. Please don't. I don't want an official library to exist to facilitate people harvesting and selling my email address without me knowing the source of the leak. > I may, however, be somewhat biased as I am the frequent recipient of email from weird services that some other chucklehead keeps signing up for even though he has yet to get past email verification as he doesn’t own the address. And you have existing accounts with all of these services? Or how does this relate to service providers striping dots when checking uniqueness? You should report those emails as spam. If you never verified the email address they have no right to continue to send emails to you.

shkkmo 9y ago

> Why can't it be both sides' issue? Even if Google didn't provide this feature to their users (and it is a feature that I regularly use to track who leaks my email address and then auto block emails to that address), Netflix's approach of sending sensitive emails without verifying the email address is still prone to security problems. Many people have multiple email accounts, or aren't really aware which email account they used to sign up. Sending a "please update your billing info" without verifying the email account first is purely on Netflix.