4 ms·

I'd argue the crux is about proving that Me The Service can send You The User whatever info is needed (password reset, notification of planned downtimes, pricin

I'd argue the crux is about proving that Me The Service can send You The User whatever info is needed (password reset, notification of planned downtimes, pricing changes, warnings about service abuse) to this address - and you'll get it. I don't care about you "controlling" an email address - you can easily get fake ones for free. It's about both parties having agreed _at least once_ on a way for the service to communicate important stuff to you.

klabb3 4y ago
> It's about both parties having agreed _at least once_ on a way for the service to communicate important stuff to you. Exactly. And the most important thing is password reset, because users forgetting passwords is the one true constant in the universe. Even if I'm not planning to spam you with newsletter crap, I'm still going to ask for your email just for this reason, otherwise I will get inf support tickets about lost accounts and worse, users who just give up. It helps thinking of the pw reset flow as the true persistent identity/login and password is simply a shorthand. Magic links have virtually identitical security. With just marginally better end-to-end UX, the majority of users would prefer it. (For instance, note the iOS 2fa through text messages, that automatically scrapes the confirmation code and offers to insert it, without leaving the app).
- nmz 4y ago
  With this method, it seems to me the entire user registration information would be in your Sent folder. So forgetting the password should be more difficult. Though you would still need to reset a password.
  - deleted 4y ago
    [deleted]
weird-eye-issue 4y ago
What's a "fake" email address? If you can get emails to an email address then it isn't fake and you are in control of it, at least for the time being
- Kwpolska 4y ago
  All the various 10-minute-mail services.
  - weird-eye-issue 4y ago
    Not really fake if you can receive email is it? Maybe disposable is a better word
dcow 4y ago
Ownership over the email shortname is exactly what is being proven. It’s your identity as far as the service is concerned. I can block emails from a service right after verifying so verifying does not guarantee that I will receive emails from the service at any point in the future.
- withinboredom 4y ago
  If you do block it, your access to the account you’ve created might be in jeopardy. At least it depends on how you “block” it. If the service receives an error on future emails, the user’s account can be disabled, as usually described in the TOS.

klabb3 4y ago

> It's about both parties having agreed _at least once_ on a way for the service to communicate important stuff to you. Exactly. And the most important thing is password reset, because users forgetting passwords is the one true constant in the universe. Even if I'm not planning to spam you with newsletter crap, I'm still going to ask for your email just for this reason, otherwise I will get inf support tickets about lost accounts and worse, users who just give up. It helps thinking of the pw reset flow as the true persistent identity/login and password is simply a shorthand. Magic links have virtually identitical security. With just marginally better end-to-end UX, the majority of users would prefer it. (For instance, note the iOS 2fa through text messages, that automatically scrapes the confirmation code and offers to insert it, without leaving the app).

nmz 4y ago
With this method, it seems to me the entire user registration information would be in your Sent folder. So forgetting the password should be more difficult. Though you would still need to reset a password.
- deleted 4y ago
  [deleted]

weird-eye-issue 4y ago

What's a "fake" email address? If you can get emails to an email address then it isn't fake and you are in control of it, at least for the time being

Kwpolska 4y ago
All the various 10-minute-mail services.
- weird-eye-issue 4y ago
  Not really fake if you can receive email is it? Maybe disposable is a better word

dcow 4y ago

Ownership over the email shortname is exactly what is being proven. It’s your identity as far as the service is concerned. I can block emails from a service right after verifying so verifying does not guarantee that I will receive emails from the service at any point in the future.

withinboredom 4y ago
If you do block it, your access to the account you’ve created might be in jeopardy. At least it depends on how you “block” it. If the service receives an error on future emails, the user’s account can be disabled, as usually described in the TOS.