5 ms·

So many products make email verification optional in order to improve their funnel. But it's a huge security risk, because it leads to bugs like this. Very few

So many products make email verification optional in order to improve their funnel. But it's a huge security risk, because it leads to bugs like this. Very few engineers and PMs will actually stop to think: "Wait, what if the user's email address isn't verified?" I kind of wish we could just pass a law that says you have to validate email addresses before attaching them to accounts at all. Because otherwise, competitive pressure will keep pushing people towards not doing it and aiming this gun at their foot in the name of conversions. In the absence of a law: If your service insists on allowing unverified email addresses, you should store them in a completely different place in your database from verified ones. Maybe even obfuscate them with some encoding. Do whatever you can to make it really hard for anyone to accidentally rely on an unverified address. Ideally make it impossible for anyone except the team in charge of authentication to even see an unverified address. On another note, holy shit. So many people (myself included) chose Google Domains specifically because they thought it would be secure and trustworthy, because it's Google. Won't make that mistake again.

justin_oaks 2y ago
At a previous job I complained to company leadership that we shouldn't trust email addresses without verification. I think the company eventually required verification, not because their trusted employee told them, but because a security review of the product pointed out the lack of email verification.
- zadokshi 2y ago
  When it’s a security review and something is on paper, there is now documentation of potential liability. When it’s just a random staff member complaining they want to do something that makes it harder to onboard customers, there’s no proof of incompetence, and incompetence can still be blamed on the developers.
  - lionkor 2y ago
    Does that mean that suggestions like that should maybe be sent by email, with multiple important people CCd?
    - daemin 2y ago
      Yes. But for what purpose will you be sending it - to cover your ass, or to make yourself feel superior? Also keep in mind that the company has full access to your work email account therefore they could delete the email if they wanted to. Not likely they would in general but people have been known to do all sorts of things in situations where a written record could hurt them.
      - diggan 2y ago
        > Yes. But for what purpose will you be sending it - to cover your ass, or to make yourself feel superior? What about for the purpose of improving the product you're (assumingly) full-time employed on? Telling that that wasn't one of your hypothetical reasons :)
        daemin 2y ago
        To suggest a feature or describe an issue on a product you're working on can be most easily done by just talking to people, for example by bringing it up in a design or planning meeting with the team and management. If it gets picked up it will get added to the schedule in some written form. It does not need to specifically communicated by email or written down, unless explicitly asked for. Therefore the main purpose of writing the initial suggestion down is so there's a record of it for future use. Either to cover your own ass when management/auditors/lawyers get involved, or to say you were right and management was wrong and make yourself feel superior.
        loa_in_ 2y ago
        It might be not required to write it down but there's no need to say that doing so attributes to one anything beyond act of communication.
AndrewMohawk 2y ago
I think this is genuinely a good takeaway, its so easy for these two sides to assume something about the other (ie we have validated) that you can see how it can happen.
Jerrrry 2y ago
>kind of wish we could just pass a law that says you have to validate email addresses before attaching them to accounts at all. We did, the government can only collect the data it needs to complete it's stated objective. fedramp compliance. This exact exploit has happened at nearly every Fortune500 company. > otherwise, competitive pressure will keep pushing people towards not doing it and aiming this gun at their foot in the name of conversions Market forces, people should be pressured to use more secured services.
- zacmps 2y ago
  One of the (many) problems with the market is that consumers have imperfect information. In this case specifically it's almost never possible to have an accurate picture of a company's security in advance of a mistake like this one.
- warkdarrior 2y ago
  > Market forces, people should be pressured to use more secured services. There is no such pressure in the market right now. Look at the email-provider market, where secure offering like Proton Mail are nowhere close to less secure ones like Gmail, Outlook/Live.com, etc. Why don't people just flock to Proton Mail?
  - rstupek 2y ago
    What makes Proton Mail more secure than Gmail et. al.?
    - warkdarrior 2y ago
      Proton offers E2EE for mail, files, and calendar events. Gmail does not.
      - sieabahlpark 2y ago
        [dead]
      - 2y ago
seaal 2y ago
I choose Google Domains just for the ease of use but when it came time to move there was no way I was transferring to Squarespace. I'm not sure how long I'll stick with Cloudflare, but for now they will do.
- ggm 2y ago
  I went to joker, for much the same reason. Their initial login page is the only one I know which proffers the 2FA input along with the password, a design feature I really like. And, they correctly applied my "automatic renewal" to NOT pre-emptively renew now, but say it will happen on the anniversary so I don't lose any of the last day(s) value. Joker was recommended to me by another techie. Its German. I was extremely disappointed google walked away from the domain game, because their interface was simple, logical and ironclad. I do not see how they possibly had costs in this which were not exceeded by the profits, and "click here" benefits for GCP and related product.
  - masfuerte 2y ago
    I've been using joker for nearly twenty years and it has always just worked. I'm probably misunderstanding you, but when you renew a domain you get an extra year (or whatever) measured from the expiry date, not measured from the renewal date. Renewing early doesn't lose you anything (except a bit of cash flow). This is true for .com and .uk anyway.
    - ggm 2y ago
      Other companies I have used applied the cash at the date renewed and changed the annual expiry date to the payment date.
toast0 2y ago
> I kind of wish we could just pass a law that says you have to validate email addresses before attaching them to accounts at all. Because otherwise, competitive pressure will keep pushing people towards not doing it and aiming this gun at their foot in the name of conversions. Would also help when people don't get their receipts or reminders or etc because they gave the company someone else's email. I think I've got three people who think my gmail is their address. And I can't just give up and close it because Google won't let you use a non gmail account as an Android account. Has to be gmail or whatever G Suite is called today.
omoikane 2y ago
I might charitably and optimistically interpret the transfer to Squarespace as one of many short-sighted decisions that Google made that's unique to 2023, the period where Google had its greatest internal turmoil shortly after the layoffs. Every year before 2023 was better and Google will only get better from 2024 onwards. Though personally, when I heard that Google is selling off Google Domains, I immediately transferred my domain elsewhere. Not necessarily because I hate any of the parties involved, but because a transfer at that time was fully within my control with fewer unknowns, unlike waiting for some bulk migration with no announced timeline.
- Thorrez 2y ago
  Google did large layoffs in Jan 2023 and Jan 2024, and smaller rolling layoffs continue, including layoffs in May 2024. https://layoffs.fyi/ https://layoffs.fyi/
meroes 2y ago
It used to be every site would require a verification email be clicked through. Later on some didn’t. I thought they must have some extra and impressive security to pull this off. Turns out they likely all have nothing in place to make up the gap.
immibis 2y ago
> Won't make that mistake again. Is your company using Google's cloud office products? Gmail?

justin_oaks 2y ago

At a previous job I complained to company leadership that we shouldn't trust email addresses without verification. I think the company eventually required verification, not because their trusted employee told them, but because a security review of the product pointed out the lack of email verification.

zadokshi 2y ago
When it’s a security review and something is on paper, there is now documentation of potential liability. When it’s just a random staff member complaining they want to do something that makes it harder to onboard customers, there’s no proof of incompetence, and incompetence can still be blamed on the developers.
- lionkor 2y ago
  Does that mean that suggestions like that should maybe be sent by email, with multiple important people CCd?
  - daemin 2y ago
    Yes. But for what purpose will you be sending it - to cover your ass, or to make yourself feel superior? Also keep in mind that the company has full access to your work email account therefore they could delete the email if they wanted to. Not likely they would in general but people have been known to do all sorts of things in situations where a written record could hurt them.
    - diggan 2y ago
      > Yes. But for what purpose will you be sending it - to cover your ass, or to make yourself feel superior? What about for the purpose of improving the product you're (assumingly) full-time employed on? Telling that that wasn't one of your hypothetical reasons :)
      - daemin 2y ago
        To suggest a feature or describe an issue on a product you're working on can be most easily done by just talking to people, for example by bringing it up in a design or planning meeting with the team and management. If it gets picked up it will get added to the schedule in some written form. It does not need to specifically communicated by email or written down, unless explicitly asked for. Therefore the main purpose of writing the initial suggestion down is so there's a record of it for future use. Either to cover your own ass when management/auditors/lawyers get involved, or to say you were right and management was wrong and make yourself feel superior.
        loa_in_ 2y ago
        It might be not required to write it down but there's no need to say that doing so attributes to one anything beyond act of communication.

AndrewMohawk 2y ago

I think this is genuinely a good takeaway, its so easy for these two sides to assume something about the other (ie we have validated) that you can see how it can happen.

Jerrrry 2y ago

>kind of wish we could just pass a law that says you have to validate email addresses before attaching them to accounts at all. We did, the government can only collect the data it needs to complete it's stated objective. fedramp compliance. This exact exploit has happened at nearly every Fortune500 company. > otherwise, competitive pressure will keep pushing people towards not doing it and aiming this gun at their foot in the name of conversions Market forces, people should be pressured to use more secured services.

zacmps 2y ago
One of the (many) problems with the market is that consumers have imperfect information. In this case specifically it's almost never possible to have an accurate picture of a company's security in advance of a mistake like this one.
warkdarrior 2y ago
> Market forces, people should be pressured to use more secured services. There is no such pressure in the market right now. Look at the email-provider market, where secure offering like Proton Mail are nowhere close to less secure ones like Gmail, Outlook/Live.com, etc. Why don't people just flock to Proton Mail?
- rstupek 2y ago
  What makes Proton Mail more secure than Gmail et. al.?
  - warkdarrior 2y ago
    Proton offers E2EE for mail, files, and calendar events. Gmail does not.
    - sieabahlpark 2y ago
      [dead]
    - 2y ago

seaal 2y ago

I choose Google Domains just for the ease of use but when it came time to move there was no way I was transferring to Squarespace. I'm not sure how long I'll stick with Cloudflare, but for now they will do.

ggm 2y ago
I went to joker, for much the same reason. Their initial login page is the only one I know which proffers the 2FA input along with the password, a design feature I really like. And, they correctly applied my "automatic renewal" to NOT pre-emptively renew now, but say it will happen on the anniversary so I don't lose any of the last day(s) value. Joker was recommended to me by another techie. Its German. I was extremely disappointed google walked away from the domain game, because their interface was simple, logical and ironclad. I do not see how they possibly had costs in this which were not exceeded by the profits, and "click here" benefits for GCP and related product.
- masfuerte 2y ago
  I've been using joker for nearly twenty years and it has always just worked. I'm probably misunderstanding you, but when you renew a domain you get an extra year (or whatever) measured from the expiry date, not measured from the renewal date. Renewing early doesn't lose you anything (except a bit of cash flow). This is true for .com and .uk anyway.
  - ggm 2y ago
    Other companies I have used applied the cash at the date renewed and changed the annual expiry date to the payment date.

toast0 2y ago

> I kind of wish we could just pass a law that says you have to validate email addresses before attaching them to accounts at all. Because otherwise, competitive pressure will keep pushing people towards not doing it and aiming this gun at their foot in the name of conversions. Would also help when people don't get their receipts or reminders or etc because they gave the company someone else's email. I think I've got three people who think my gmail is their address. And I can't just give up and close it because Google won't let you use a non gmail account as an Android account. Has to be gmail or whatever G Suite is called today.

omoikane 2y ago

I might charitably and optimistically interpret the transfer to Squarespace as one of many short-sighted decisions that Google made that's unique to 2023, the period where Google had its greatest internal turmoil shortly after the layoffs. Every year before 2023 was better and Google will only get better from 2024 onwards. Though personally, when I heard that Google is selling off Google Domains, I immediately transferred my domain elsewhere. Not necessarily because I hate any of the parties involved, but because a transfer at that time was fully within my control with fewer unknowns, unlike waiting for some bulk migration with no announced timeline.

Thorrez 2y ago
Google did large layoffs in Jan 2023 and Jan 2024, and smaller rolling layoffs continue, including layoffs in May 2024. https://layoffs.fyi/ https://layoffs.fyi/

meroes 2y ago

It used to be every site would require a verification email be clicked through. Later on some didn’t. I thought they must have some extra and impressive security to pull this off. Turns out they likely all have nothing in place to make up the gap.

immibis 2y ago

> Won't make that mistake again. Is your company using Google's cloud office products? Gmail?