6 ms·

I read those links and it just makes me sad. I don't understand why so many developers do so many stupid things with emails. Sure, there's some trivial validat

I read those links and it just makes me sad. I don't understand why so many developers do so many stupid things with emails. Sure, there's some trivial validation you can do that makes sense - make sure it matches (.+)@(.+), make sure the domain part exists, etc. But far too many sites do extra 'validation' using weird restrictive regex, and it prevents you from using valid email addresses - things like restricting chars so I can't use '+', or so I can't use a one char local part, or a one char domain, or a newer TLD that doesn't fit some dodgy regex they copied from a random stack overflow comment... I really wish that developers would just do really simplistic checks - eg make sure it has an @ in it and something either side, and then just send a validation email as part of their signup flow. If you do it as the first step in the flow, you validate control of the email address and you ensure you don't end up with junk accounts on your system where someone typo'd their email and will never be able to activate it. edit: the really stupid thing is that it takes considerably more effort to add this restrictive and usually wrong validation than it does to do it right :(

OtomotO 4y ago
The same is true for passwords. With every restriction, the space of possible passwords becomes smaller. Just 16 chars, you must use a number, a special character, but not any of these few of course... Just give it a length of 255 and people can use arbitrary sentences as passwords, which they remember! Then teach them to add some slight variants to them, like replacing a char by a number, adding commas etc. Instead we get "passwordless"
- stavros 4y ago
  > Instead we get "passwordless" Which is a much better solution.
  - OtomotO 4y ago
    For the dystopian cyberpunk future where a few companies rule the world, yup. I will stay with passwords that only a quantum computer can break :) To elaborate a bit more, as we are already off topic: Biometric traits are a big nono for me. And another device just shifts the password problem to said device (same for email account instead of device). Once someone has access to the device (secured via one password) they have access to everything. So a normal trade in convenience for security. Passwords are solved for me, apart from idiotic rulesets on the other end.
    - stavros 4y ago
      There isn't only one way to do passwordless. WebAuthn is a very good solution.
      - OtomotO 4y ago
        A long, easy to remember, but hard go guess password, that is securely hashed on the other end, is an even better solution, that is proven and battle tested.
        stavros 4y ago
        No, it isn't. A password can be phished, a hardware key can't, among a ton of other benefits. The hardware key is orders of magnitude better than a password.
        TheChaplain 4y ago
        Until the moment you arrive at work after 1.2h commute, discovering that the key is still at home... I get your point, but the above pretty much illustrates why I ditched Yubikey and now go with 2fa-app on my mobile.
        stavros 4y ago
        I don't know, my USB key is on my keychain. Turns out that if you couple your GitHub login to your way of entering your house, you never forget your GitHub login.
        prophesi 4y ago
        Another decent solution is to seed the key, and keep the seed written down or in your password manager. Though I only know of the hacker version of SoloKey that lets you do that. Now you've got the convenience of passwordless login, and the peace of mind that you can always get a new spare.

OtomotO 4y ago

The same is true for passwords. With every restriction, the space of possible passwords becomes smaller. Just 16 chars, you must use a number, a special character, but not any of these few of course... Just give it a length of 255 and people can use arbitrary sentences as passwords, which they remember! Then teach them to add some slight variants to them, like replacing a char by a number, adding commas etc. Instead we get "passwordless"

stavros 4y ago
> Instead we get "passwordless" Which is a much better solution.
- OtomotO 4y ago
  For the dystopian cyberpunk future where a few companies rule the world, yup. I will stay with passwords that only a quantum computer can break :) To elaborate a bit more, as we are already off topic: Biometric traits are a big nono for me. And another device just shifts the password problem to said device (same for email account instead of device). Once someone has access to the device (secured via one password) they have access to everything. So a normal trade in convenience for security. Passwords are solved for me, apart from idiotic rulesets on the other end.
  - stavros 4y ago
    There isn't only one way to do passwordless. WebAuthn is a very good solution.
    - OtomotO 4y ago
      A long, easy to remember, but hard go guess password, that is securely hashed on the other end, is an even better solution, that is proven and battle tested.
      - stavros 4y ago
        No, it isn't. A password can be phished, a hardware key can't, among a ton of other benefits. The hardware key is orders of magnitude better than a password.
        TheChaplain 4y ago
        Until the moment you arrive at work after 1.2h commute, discovering that the key is still at home... I get your point, but the above pretty much illustrates why I ditched Yubikey and now go with 2fa-app on my mobile.
        stavros 4y ago
        I don't know, my USB key is on my keychain. Turns out that if you couple your GitHub login to your way of entering your house, you never forget your GitHub login.
        prophesi 4y ago
        Another decent solution is to seed the key, and keep the seed written down or in your password manager. Though I only know of the hacker version of SoloKey that lets you do that. Now you've got the convenience of passwordless login, and the peace of mind that you can always get a new spare.