4 ms·
I think the biggest problem here is that the scammer has a way to include a message in the email. I've discovered that if you offer any type of service that al
by newaccount74 4y ago
I think the biggest problem here is that the scammer has a way to include a message in the email.
I've discovered that if you offer any type of service that allows sending free text messages to other people, it will be abused by spammers or scammers.
For a variation of this problem, I once programmed a sign-up form that sent a confirmation email like "Hello name, please confirm your email...". As soon as spammers found it, they used it to send millions of emails by signing up and putting their spam message in the name field.
It doesn't matter how much info you put in the email around it (like a footer warning about spam). If the email contains any text that can be provided by the attacker, it will be abused.
Paypal should probably not include the seller note in the email, and show the invoice to the user only after asking if they are expecting an invoice.
- Gys 4y agoMaybe limit the name length (client and server side) to 20 chars or so.
- citrin_ru 4y agoA shortened URL would fit into 20 chars (while some names don't) and I see this being widely abuse. One also would need a regexp to not allow things like URLs and phone numbers (but allow names in any language).
- 8organicbits 4y agoBut be careful, this is one of of falsehoods programmers believe about names [1]. My name needs 16 characters, so 20 as a limit bothers me personally. For this example I'd suggest allowing long names. No one wants to have a computer say "your name is not valid". However, if the goal of personalized email is to be friendly, or some other non-functional reason, consider only including the name in the email if its "short" enough. That seems like a graceful degradation that would limit spam. Edit: or to address the URL/phone number concern, allow the user to pick that as their name, but not include it in the email. [1] https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/ https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...
- Dylan16807 4y agoIt's only a falsehood if you expect it to hold everyone's full name. No need to call any names invalid just to ask for something shorter.
- kstenerud 4y ago20 characters is not nearly enough for Hubert Wolfeschlegelsteinhausenbergerdorffwelchevoralternwarengewissenhaftschaferswessenschafewarenwohlgepflegeundsorgfaltigkeitbeschutzenvonangreifendurchihrraubgierigfeindewelchevoralternzwolftausendjahresvorandieerscheinenvanderersteerdemenschderraumschiffgebrauchlichtalsseinursprungvonkraftgestartseinlangefahrthinzwischensternartigraumaufdersuchenachdiesternwelchegehabtbewohnbarplanetenkreisedrehensichundwohinderneurassevonverstandigmenschlichkeitkonntefortpflanzenundsicherfreuenanlebenslanglichfreudeundruhemitnichteinfurchtvorangreifenvonandererintelligentgeschopfsvonhinzwischensternartigraum's name.
- arbuge 4y agoA good chunk of the internet runs on varchar(255) name fields... Hubert's life is going to be rough out there.
- DougMerritt 4y agoIt's surprising so many families (well, family names) survived the punch card days, when name fields were necessarily limited to something like 20 to 40 characters.
- axus 4y agoAbout 6 months ago, I got a very short invoice for $500 from "Patricia Snook". I can't even remember if there was a message. Actually was reminded about this a week ago, when Paypal sent me a message that "Ms. Snook" had cancelled the invoice.