undefined

points

[-]

on most services you sign up by using an email address (or a phone number) as an identifier. these need to be verified to make sure it's actually yours and not someone else's, or a typo.

by direwolf202 days ago|

parent|

[-]

If you used a username, you wouldn't have this problem. As it stands, signing up someone else's address for a lot of sites to spam them with confirmations is already an attack vector that's used in the wild. And that's legitimate spam and should be reported as spam and sites that do this are spam amplifiers.

by ryandrake2 days ago|

parent|

prev|

[-]

They don't need to be verified through E-mail or through the phone, though. A simple landing page after you sign up that says: "We signed up [E-mail] for this service using [phone number]. If this is incorrect, [click here] to make corrections" would work, too.

Frankly, I'm getting tired of having to constantly "verify" this and "confirm" that every time I sign up for or log into an online service. It's especially annoying after I've already signed up. Every bank that I haven't logged into for the last 5 milliseconds hits me with a "confirm your E-mail yet again" flow. I'm going to just start using "password" for my password if these guys keep insisting on round-tripping through my E-mail every time I need to do anything.

by gus_massa2 days ago|

parent|

[-]

We didn't want too many fake accounts. We didn't ask for phone numbers. It's very easy to get a burner email, in case someone wanted to avoid giving the main email. Burner phone numbers are harder.

Also, an important use is password and username recovery. We even got password or username request 30 minutes after signup! They had quiz to solve if they want to help during studding and it's good to track them.

We had a lot of wrong emails, in particular it was common someone@yahoo.com instead of someone@yahoo.com.ar because Yahoo! offer both options. Also someone@gmail.com.ar that does not exist, but that never stop users.

(If it help, we never asked to confirm the email again after the registration.)

by em-bee2 days ago|

parent|

prev|

[-]

how do you prevent malicious use intentionally signing up someone else without verification? and how do you verify your own email if you are not technically competent enough to know how to spell your email correctly? (probably not an issue for students, but just seeing stories here on hackernews about people receiving emails not meant for them shows that this is an issue)

by ryandrake2 days ago|

parent|

[-]

I guess whether that matters depends on the actual application. As long as it's not spamming (E-mail or phone), the impact of having an incorrect email address may be low.