4 ms·

Permitting separate "sarah.jones" and "sarahjones" accounts would be pretty bad, too. Too easy to impersonate people. "Dots matter but are not included in uniqu

by djur 9y ago

Permitting separate "sarah.jones" and "sarahjones" accounts would be pretty bad, too. Too easy to impersonate people. "Dots matter but are not included in uniqueness checks" is probably the safest approach.

shkkmo 9y ago
While you CAN strip periods in the local part of the email and convert them to lower case before checking uniqueness, you do this as the risk of improperly disallowing valid and distinct addresses. A better solution is to check for similar address and provide a prompt "do you already have an account with this address:" rather than completely blocking registration with that address. However, you should definitely not do these things to the address that you save for the purposes of sending email because then you risk improperly sending emails to the wrong person. In general, validating the format of an email address is both extremely hard and pointless (since only a small portion of mis-entries will results in an invalid email address). Pretty much the only way to validate an email address effectively is to verify it by sending an email to it and expecting the user to click an email.
- djur 9y ago
  To be clear, I'm talking about what email providers could do to reduce the risk of confusion, not what email senders should do to validate emails. I agree that the only way to validate an email address is to send a confirmation.
  - shkkmo 9y ago
    Except it does little to nothing to reduce confusion. It does nothing to fix the problem of people signing up using an email with a typo or with an email that doesn't actually belong to them. This on service providers to implement secure access properly.
    - djur 9y ago
      I'm not thinking primarily of transactional emails here. If Gmail allowed dots and allowed registering both "jane.smith" and "janesmith", Jane Smith would be well-advised to register both, because it's going to be the most common mistake people make. It's the same principle that suggests that if you own a .org address you should probably go ahead and buy the .com, too.
- coredog64 9y ago
  Gmail is a fairly common mail host. Doing what you suggest for ‘@gmail.com’ addresses would be an easy solution. You could also make the case that Google should have a free library for most common languages that does this for you. It would improve the safety of their users immensely. I may, however, be somewhat biased as I am the frequent recipient of email from weird services that some other chucklehead keeps signing up for even though he has yet to get past email verification as he doesn’t own the address.
  - shkkmo 9y ago
    > You could also make the case that Google should have a free library for most common languages that does this for you. It would improve the safety of their users immensely. Please don't. I don't want an official library to exist to facilitate people harvesting and selling my email address without me knowing the source of the leak. > I may, however, be somewhat biased as I am the frequent recipient of email from weird services that some other chucklehead keeps signing up for even though he has yet to get past email verification as he doesn’t own the address. And you have existing accounts with all of these services? Or how does this relate to service providers striping dots when checking uniqueness? You should report those emails as spam. If you never verified the email address they have no right to continue to send emails to you.

by djur 9y ago

shkkmo 9y ago

While you CAN strip periods in the local part of the email and convert them to lower case before checking uniqueness, you do this as the risk of improperly disallowing valid and distinct addresses. A better solution is to check for similar address and provide a prompt "do you already have an account with this address:" rather than completely blocking registration with that address. However, you should definitely not do these things to the address that you save for the purposes of sending email because then you risk improperly sending emails to the wrong person. In general, validating the format of an email address is both extremely hard and pointless (since only a small portion of mis-entries will results in an invalid email address). Pretty much the only way to validate an email address effectively is to verify it by sending an email to it and expecting the user to click an email.

djur 9y ago
To be clear, I'm talking about what email providers could do to reduce the risk of confusion, not what email senders should do to validate emails. I agree that the only way to validate an email address is to send a confirmation.
- shkkmo 9y ago
  Except it does little to nothing to reduce confusion. It does nothing to fix the problem of people signing up using an email with a typo or with an email that doesn't actually belong to them. This on service providers to implement secure access properly.
  - djur 9y ago
    I'm not thinking primarily of transactional emails here. If Gmail allowed dots and allowed registering both "jane.smith" and "janesmith", Jane Smith would be well-advised to register both, because it's going to be the most common mistake people make. It's the same principle that suggests that if you own a .org address you should probably go ahead and buy the .com, too.
coredog64 9y ago
Gmail is a fairly common mail host. Doing what you suggest for ‘@gmail.com’ addresses would be an easy solution. You could also make the case that Google should have a free library for most common languages that does this for you. It would improve the safety of their users immensely. I may, however, be somewhat biased as I am the frequent recipient of email from weird services that some other chucklehead keeps signing up for even though he has yet to get past email verification as he doesn’t own the address.
- shkkmo 9y ago
  > You could also make the case that Google should have a free library for most common languages that does this for you. It would improve the safety of their users immensely. Please don't. I don't want an official library to exist to facilitate people harvesting and selling my email address without me knowing the source of the leak. > I may, however, be somewhat biased as I am the frequent recipient of email from weird services that some other chucklehead keeps signing up for even though he has yet to get past email verification as he doesn’t own the address. And you have existing accounts with all of these services? Or how does this relate to service providers striping dots when checking uniqueness? You should report those emails as spam. If you never verified the email address they have no right to continue to send emails to you.