6 ms·

That's fine as long as you send a welcome email immediately that says "If you didn't create this account, use this link and you'll never get another email at th

That's fine as long as you send a welcome email immediately that says "If you didn't create this account, use this link and you'll never get another email at this address". I've seen services forget that, and then it's possible to sign up with someone else's email address, use the account, and have someone else get spammed or harassed. That needs to be part of your threat model. "What if a bot signs up" is about protecting your service and people using it. "What happens if someone signs up with someone else's information" is about protecting other people, who may have nothing to do with the service.

jlokier 7y ago
> "If you didn't create this account, use this link and you'll never get another email at this address" If I get an unsolicited email for a service I don't recognise, that has a link in it and a message asking me to click on it, should I click on it? Commmon advice is don't click on links in mails you aren't expecting. It just confirms your address is real for spam harvesting.
- Gene_Parmesan 7y ago
  This is what I've heard as well, although I've never actually confirmed it to be true.
- bcrosby95 7y ago
  I don't know who gives that advice, but it seems poorly thought out. Email providers already tell people sending email when an address is real or not. You clicking the link would tell them you read your email. I'm also not sure what you're afraid of. If your account has been in existence for long enough, you already get a lot of spam. It just gets blocked or filtered. The vast majority of your emails that actually get to your inbox are from people trying to do the right thing, not people trying to screw you over.
  - Hnrobert42 7y ago
    I think they are afraid of a phishing attack that requires a click to land a remote code exploit.
  - sokoloff 7y ago
    > Email providers already tell people sending email when an address is real or not. I don’t think email works the way you seem to think it works.
    - bcrosby95 7y ago
      Email deliverability was part of my job for around 8 years. Providers will absolutely send you a bounce message (via the return path email) if an inbox does not exist. Or even if it is full. The messaging is not standard so you have to do all sorts of special case parsing because each provider can give a different message. And ignoring these messages will hurt your ability to deliver email. So if your plan is to hide your address from people, again, I don't see the point.
      - sokoloff 7y ago
        I believe there's value to marketers to know "this email address somewhat reliably hits a human's eyeballs" as evidenced by a click-to-unsubscribe or click-to-refute action as a stronger signal than "well, we didn't get a bounce". "Email providers already tell people sending email when an address is real or not." suggests a level of reliability of signal that simply doesn't exist. I have an infinite number of email addresses that you could send to, which would not give you a bounce, and none of which will reliably land in front of a human's eyeballs.
        deleted 7y ago
        [deleted]
        deleted 7y ago
        [deleted]
  - jlokier 7y ago
    > Email providers already tell people sending email when an address is real or not. You clicking the link would tell them you read your email. My bad for lack of clarity. I meant whether the address has a person reading it, making it a more valuable target, perhaps added to a commercially sold database. I don't know if or how much this happens. But it's obviously an available signal. > If your account has been in existence for long enough, you already get a lot of spam. True! I got 6000 spam a day at one point. Thankfully it went down to 1000 a day and has slowed since. > It just gets blocked or filtered. Unfortunately not so well. The vast majority is filtered, but that still leaves too much getting through (I got about 80 in the last 45 hours), and in conjunction with such a high level of false positives that good things go to the spam bucket, a problem both as a recipient and a sender. Gmail is not immune either; I often find critical false positives in my Gmail spam folder. Spam is not a solved problem, and the solutions are causing other problems. I don't have solutions, but I don't agree that it's "just" blocked or filtered. If only email was that reliable!
  - deleted 7y ago
    [deleted]
bonestamp2 7y ago
Yes, I completely agree. This should be standard for all account welcome emails.
RyJones 7y ago
For a long time, Uber didn't validate email addresses; lots of people set up accounts using my gmail address. I had no recourse.
- bonestamp2 7y ago
  For eight years, I've been trying to get my email address out of Xfinity's databases. The customer support team literally can't find my email address in their system and I still get emails. They passed my case on to engineering and they can't find it either. Not only have I never been an Xfinity customer, I've never even lived in an area where I could have be an Xfinity customer. Thankfully, the emails are few and far between now.
  - Reason077 7y ago
    Just set up a filter to delete them. I've been doing this for all Facebook emails for years.
    - bonestamp2 7y ago
      Yes, I do have a filter for them. But it's still annoying since it's just shifting the problem -- now I have a growing list of filters to maintain. But I appreciate the suggestion.
  - the_pwner224 7y ago
    > Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $43,280, so non-compliance can be costly. https://www.ftc.gov/tips-advice/business-center/guidance/can-spam-act-compliance-guide-business https://www.ftc.gov/tips-advice/business-center/guidance/can... From what you said it appears every single one of their emails is a violation. I don't know how much time it will take you to actually pursue that or whether it will be worth the time, but I'm sure lots of people will be very happy if you make Comcast lose a bunch of money.
johndough 7y ago
I fully agree. A while ago, I registered a domain name consisting of adjacent keyboard letters and set up a catch all email address (huge mistake). Next, I got roughly 1000 mails per week, of which fifty were promotional offers sent to "my" Verizon accounts. Of course it is impossible to reach any human being at Verizon to get this fixed.
- ValentineC 7y ago
  What email host are you using? Have you considered blacklisting individual email addresses?
101404 7y ago
That's illegal. You want me to opt-out in order to stop spamming me? Nope. I will never click a link in some spam mail I receive. Even if you claim that your service is "legitimate". If you want to be allowed to email me, you must often a double opt-in. And that is a click to confirm the address.
- JoshTriplett 7y ago
  That's not what I was suggesting at all. If your service actually sends people emails (other than, say, password resets), then you still need them to follow a "verify your email" link before sending them mails other than the single "welcome" message containing that link. I'm just saying that you don't need to wait for email verification before letting people make and use an account, as long as you don't send them any more emails beyond the welcome message. Many services don't send regular emails, and only ask for an email so that 1) everyone has a unique identifier without having to make up a unique username, and 2) they can do password resets. For such services, the procedure above makes sense to reduce friction.
  - abiogenesis 7y ago
    I still wouldn't want someone else to be able to register for some service using my email. What happens if I want to use the same service in the future? That happens to me all the time as I have a very generic email address (one of the first users of Gmail). Someone seems to have registered to Facebook with my email and now I can't disassociate it. People searching me by my email address on Facebook end up with that random guy.
    - cortesoft 7y ago
      Shouldn't you be able to request a password reset, which would send an email to you and then you would delete it?
      - abiogenesis 7y ago
        Already tried that. It asks me that other person's private information (such as date of birth).
pottertheotter 7y ago
Far too many websites don't do this. A lot of people seem to think that my Gmail address is their's, so I end up signed up for a lot of email lists. I'm sure Apple is good about this now, but many years ago someone had used my Gmail address for their Apple ID. I wanted to switch my Apple account to use my Gmail, but couldn't because someone else's account used it. Support told me they couldn't do anything about it. I don't know why it didn't occur to me to do this first, but I just reset their password, changed the email address to something else, and reclaimed my email.
- bbx 7y ago
  > I just reset their password, changed the email address to something else, and reclaimed my email. I understand it’s the other user’s fault for using your email address in the first place, but I wonder if you could have contacted them to warn them about the change (since they would lose access to their Apple account instantly, with no recovery option). I’m not blaming you. I’m just wondering how it would be done, if needed. I assume that user, when signing up with your email, either a) made a mistake b) was being unhelpful c) or didn’t understand he whole email/ID concept.
  - emilecantin 7y ago
    I've been on the receiving end of a similar thing (but with a gaming website), and there's a flaw with your logic: How would you contact them? The email address they used is yours, it's not like you can just send them an email, you don't have their address.
- SenHeng 7y ago
  Apple's obviously not going to revert the previous AppleID to your email but I would bet that address is on some kind of 'might be sketchy' list now.
encoderer 7y ago
(in case anybody needs to hear it, this is not a launch requirement)
- JoshTriplett 7y ago
  It only takes one high-profile spamming incident to kill your reputation. This isn't hard to implement.

jlokier 7y ago

> "If you didn't create this account, use this link and you'll never get another email at this address" If I get an unsolicited email for a service I don't recognise, that has a link in it and a message asking me to click on it, should I click on it? Commmon advice is don't click on links in mails you aren't expecting. It just confirms your address is real for spam harvesting.

Gene_Parmesan 7y ago
This is what I've heard as well, although I've never actually confirmed it to be true.
bcrosby95 7y ago
I don't know who gives that advice, but it seems poorly thought out. Email providers already tell people sending email when an address is real or not. You clicking the link would tell them you read your email. I'm also not sure what you're afraid of. If your account has been in existence for long enough, you already get a lot of spam. It just gets blocked or filtered. The vast majority of your emails that actually get to your inbox are from people trying to do the right thing, not people trying to screw you over.
- Hnrobert42 7y ago
  I think they are afraid of a phishing attack that requires a click to land a remote code exploit.
- sokoloff 7y ago
  > Email providers already tell people sending email when an address is real or not. I don’t think email works the way you seem to think it works.
  - bcrosby95 7y ago
    Email deliverability was part of my job for around 8 years. Providers will absolutely send you a bounce message (via the return path email) if an inbox does not exist. Or even if it is full. The messaging is not standard so you have to do all sorts of special case parsing because each provider can give a different message. And ignoring these messages will hurt your ability to deliver email. So if your plan is to hide your address from people, again, I don't see the point.
    - sokoloff 7y ago
      I believe there's value to marketers to know "this email address somewhat reliably hits a human's eyeballs" as evidenced by a click-to-unsubscribe or click-to-refute action as a stronger signal than "well, we didn't get a bounce". "Email providers already tell people sending email when an address is real or not." suggests a level of reliability of signal that simply doesn't exist. I have an infinite number of email addresses that you could send to, which would not give you a bounce, and none of which will reliably land in front of a human's eyeballs.
      - deleted 7y ago
        [deleted]
      - deleted 7y ago
        [deleted]
- jlokier 7y ago
  > Email providers already tell people sending email when an address is real or not. You clicking the link would tell them you read your email. My bad for lack of clarity. I meant whether the address has a person reading it, making it a more valuable target, perhaps added to a commercially sold database. I don't know if or how much this happens. But it's obviously an available signal. > If your account has been in existence for long enough, you already get a lot of spam. True! I got 6000 spam a day at one point. Thankfully it went down to 1000 a day and has slowed since. > It just gets blocked or filtered. Unfortunately not so well. The vast majority is filtered, but that still leaves too much getting through (I got about 80 in the last 45 hours), and in conjunction with such a high level of false positives that good things go to the spam bucket, a problem both as a recipient and a sender. Gmail is not immune either; I often find critical false positives in my Gmail spam folder. Spam is not a solved problem, and the solutions are causing other problems. I don't have solutions, but I don't agree that it's "just" blocked or filtered. If only email was that reliable!
- deleted 7y ago
  [deleted]

bonestamp2 7y ago

Yes, I completely agree. This should be standard for all account welcome emails.

RyJones 7y ago

For a long time, Uber didn't validate email addresses; lots of people set up accounts using my gmail address. I had no recourse.

bonestamp2 7y ago
For eight years, I've been trying to get my email address out of Xfinity's databases. The customer support team literally can't find my email address in their system and I still get emails. They passed my case on to engineering and they can't find it either. Not only have I never been an Xfinity customer, I've never even lived in an area where I could have be an Xfinity customer. Thankfully, the emails are few and far between now.
- Reason077 7y ago
  Just set up a filter to delete them. I've been doing this for all Facebook emails for years.
  - bonestamp2 7y ago
    Yes, I do have a filter for them. But it's still annoying since it's just shifting the problem -- now I have a growing list of filters to maintain. But I appreciate the suggestion.
- the_pwner224 7y ago
  > Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $43,280, so non-compliance can be costly. https://www.ftc.gov/tips-advice/business-center/guidance/can-spam-act-compliance-guide-business https://www.ftc.gov/tips-advice/business-center/guidance/can... From what you said it appears every single one of their emails is a violation. I don't know how much time it will take you to actually pursue that or whether it will be worth the time, but I'm sure lots of people will be very happy if you make Comcast lose a bunch of money.

johndough 7y ago

I fully agree. A while ago, I registered a domain name consisting of adjacent keyboard letters and set up a catch all email address (huge mistake). Next, I got roughly 1000 mails per week, of which fifty were promotional offers sent to "my" Verizon accounts. Of course it is impossible to reach any human being at Verizon to get this fixed.

ValentineC 7y ago
What email host are you using? Have you considered blacklisting individual email addresses?

101404 7y ago

That's illegal. You want me to opt-out in order to stop spamming me? Nope. I will never click a link in some spam mail I receive. Even if you claim that your service is "legitimate". If you want to be allowed to email me, you must often a double opt-in. And that is a click to confirm the address.

JoshTriplett 7y ago
That's not what I was suggesting at all. If your service actually sends people emails (other than, say, password resets), then you still need them to follow a "verify your email" link before sending them mails other than the single "welcome" message containing that link. I'm just saying that you don't need to wait for email verification before letting people make and use an account, as long as you don't send them any more emails beyond the welcome message. Many services don't send regular emails, and only ask for an email so that 1) everyone has a unique identifier without having to make up a unique username, and 2) they can do password resets. For such services, the procedure above makes sense to reduce friction.
- abiogenesis 7y ago
  I still wouldn't want someone else to be able to register for some service using my email. What happens if I want to use the same service in the future? That happens to me all the time as I have a very generic email address (one of the first users of Gmail). Someone seems to have registered to Facebook with my email and now I can't disassociate it. People searching me by my email address on Facebook end up with that random guy.
  - cortesoft 7y ago
    Shouldn't you be able to request a password reset, which would send an email to you and then you would delete it?
    - abiogenesis 7y ago
      Already tried that. It asks me that other person's private information (such as date of birth).

pottertheotter 7y ago

Far too many websites don't do this. A lot of people seem to think that my Gmail address is their's, so I end up signed up for a lot of email lists. I'm sure Apple is good about this now, but many years ago someone had used my Gmail address for their Apple ID. I wanted to switch my Apple account to use my Gmail, but couldn't because someone else's account used it. Support told me they couldn't do anything about it. I don't know why it didn't occur to me to do this first, but I just reset their password, changed the email address to something else, and reclaimed my email.

bbx 7y ago
> I just reset their password, changed the email address to something else, and reclaimed my email. I understand it’s the other user’s fault for using your email address in the first place, but I wonder if you could have contacted them to warn them about the change (since they would lose access to their Apple account instantly, with no recovery option). I’m not blaming you. I’m just wondering how it would be done, if needed. I assume that user, when signing up with your email, either a) made a mistake b) was being unhelpful c) or didn’t understand he whole email/ID concept.
- emilecantin 7y ago
  I've been on the receiving end of a similar thing (but with a gaming website), and there's a flaw with your logic: How would you contact them? The email address they used is yours, it's not like you can just send them an email, you don't have their address.
SenHeng 7y ago
Apple's obviously not going to revert the previous AppleID to your email but I would bet that address is on some kind of 'might be sketchy' list now.

encoderer 7y ago

(in case anybody needs to hear it, this is not a launch requirement)

JoshTriplett 7y ago
It only takes one high-profile spamming incident to kill your reputation. This isn't hard to implement.