4 ms·

This may be very German of me, but the privacy implications of sending an email address to a third-party service before form submission appear murky to me. Als

by pudo 13y ago

This may be very German of me, but the privacy implications of sending an email address to a third-party service before form submission appear murky to me. Also, we need to find a name for "give me some personal data in return for a minimal value add service" offerings.

damoncali 13y ago
Valid concern, but in this case, it's Rackspace, not some fly by night.
- sneak 13y ago
  As well as anyone who owns Mailgun's server or logs, and any of their employees who have access to it, and NSA (FISA), and DHS (PATRIOT NSLs), et c.
  - damoncali 13y ago
    It's just an email address and you're already giving it to an unknown entity (the app using the service), but point taken.
    - Terretta 13y ago
      It's not just an address. It's an address plus the information of where the address is being used and when an account there is being established.
    - sneak 13y ago
      Actually it's thousands, perhaps millions of email addresses. Those have non-zero value in aggregate.
- claudius 13y ago
  If it’s outside the EU, you would need permission to send the address there, and after PRISM, German data protection agencies decided to block all further requests based on the safe harbour agreements with the US.
alexk 13y ago
Mailguner here: We don't store or use the email addresses that were submitted to the service.
- Terretta 13y ago
  You said this here, and in your docs, it says: "No addresses submitted to the guardpost service are ever stored on any Rackspace servers. Nothing is persisted after the request is complete." However, the API is using GET. So unless you turned off logging, you are storing all tested emails in your web server logs which most places gzip up and archive indefinitely. In other words, I'd imagine these logs "persist" after the request is complete. ADDED: As an end user, you may or may not be considered that these logs will contain: 1. Your email address 2. The place you are making an account 3. The time you created the account And this information will be stored likely indefinitely (whatever the server log retention policy is). These logs also give mailgun and/or Rackspace a great resource for the membership rolls and adoption rate of any site adopting this service.
  - paul_f 13y ago
    If this is a problem for you, then don't use it. Steal some regex off a Stack Overflow page.
Ryoku 13y ago
I have to agree with pudo. Sending a user's email to a third party service has many privacy implications. I don't care if you share, not share, store, not store, or whatever; users are trusting you not to share their emails and you should comply.
baudehlo 13y ago
Would you be interested in something open source that does this? I would be willing to release https://www.emailitin.com/email_validator https://www.emailitin.com/email_validator to github. It does all the same checks as this except for the "valid user part for Yahoo.com" stuff.
- jontas 13y ago
  I would definitely appreciate an open source option, though to be honest I am more interested in the correction feature than I am in validation. I have been using the same regex[1] for years it gets the job done adequately--at least, I've never received any complaints from users or clients. I've used the regex on some relatively high profile sites--the kind where if someone was unable to signup with a valid email address we would've definitely heard complaints. 1. http://www.regular-expressions.info/email.html http://www.regular-expressions.info/email.html
  - baudehlo 13y ago
    It does the correction feature too. Try it :)
- LambdaBoy 13y ago
  I don't think anyone could say no to more open source.
colanderman 13y ago
Perhaps a good solution would be a JS library to validate and strip the local part, then ship the non-local part to Mailgun's servers for domain validation.

by pudo 13y ago

damoncali 13y ago

Valid concern, but in this case, it's Rackspace, not some fly by night.

sneak 13y ago
As well as anyone who owns Mailgun's server or logs, and any of their employees who have access to it, and NSA (FISA), and DHS (PATRIOT NSLs), et c.
- damoncali 13y ago
  It's just an email address and you're already giving it to an unknown entity (the app using the service), but point taken.
  - Terretta 13y ago
    It's not just an address. It's an address plus the information of where the address is being used and when an account there is being established.
  - sneak 13y ago
    Actually it's thousands, perhaps millions of email addresses. Those have non-zero value in aggregate.
claudius 13y ago
If it’s outside the EU, you would need permission to send the address there, and after PRISM, German data protection agencies decided to block all further requests based on the safe harbour agreements with the US.

alexk 13y ago

Mailguner here: We don't store or use the email addresses that were submitted to the service.

Terretta 13y ago
You said this here, and in your docs, it says: "No addresses submitted to the guardpost service are ever stored on any Rackspace servers. Nothing is persisted after the request is complete." However, the API is using GET. So unless you turned off logging, you are storing all tested emails in your web server logs which most places gzip up and archive indefinitely. In other words, I'd imagine these logs "persist" after the request is complete. ADDED: As an end user, you may or may not be considered that these logs will contain: 1. Your email address 2. The place you are making an account 3. The time you created the account And this information will be stored likely indefinitely (whatever the server log retention policy is). These logs also give mailgun and/or Rackspace a great resource for the membership rolls and adoption rate of any site adopting this service.
- paul_f 13y ago
  If this is a problem for you, then don't use it. Steal some regex off a Stack Overflow page.

Ryoku 13y ago

I have to agree with pudo. Sending a user's email to a third party service has many privacy implications. I don't care if you share, not share, store, not store, or whatever; users are trusting you not to share their emails and you should comply.

baudehlo 13y ago

Would you be interested in something open source that does this? I would be willing to release https://www.emailitin.com/email_validator https://www.emailitin.com/email_validator to github. It does all the same checks as this except for the "valid user part for Yahoo.com" stuff.

jontas 13y ago
I would definitely appreciate an open source option, though to be honest I am more interested in the correction feature than I am in validation. I have been using the same regex[1] for years it gets the job done adequately--at least, I've never received any complaints from users or clients. I've used the regex on some relatively high profile sites--the kind where if someone was unable to signup with a valid email address we would've definitely heard complaints. 1. http://www.regular-expressions.info/email.html http://www.regular-expressions.info/email.html
- baudehlo 13y ago
  It does the correction feature too. Try it :)
LambdaBoy 13y ago
I don't think anyone could say no to more open source.

colanderman 13y ago

Perhaps a good solution would be a JS library to validate and strip the local part, then ship the non-local part to Mailgun's servers for domain validation.