News for hackers. Stuff that matters.
Re:Ask HN: What is the norm for email validation? by smt88 on Tuesday June 13, 2017 @03:05PM (#14547616)
What about passwordless, email-based login? It's easier than username/password login, it verifies the email address, and it provides the same level of security (assuming password can be reset via emailed link).
Re:Ask HN: What is the norm for email validation? by stephenr on Wednesday June 14, 2017 @01:21PM (#14554264)
> it provides the same level of security

No, it absolutely doesn't.

If an attacker breaches a user's mailbox, and then uses a 'forgotten password' process to gain access to another system, the user will know about it - their existing long-lived session would be killed, and the password they remember/have saved will no longer work.

If the attacker simply uses the mailbox access to use & delete "login link" emails, they could make use of this to access the victims account for as long as they have access to the mailbox.

Re:Ask HN: What is the norm for email validation? by tmnvix on Tuesday June 13, 2017 @05:29PM (#14548817)
Greylisting[0] would still be a problem. Signup is exactly the situation where this would be both most likely and most inconvenient.

[0] https://en.wikipedia.org/wiki/Greylisting

Re:Ask HN: What is the norm for email validation? by taylorcooney on Tuesday June 13, 2017 @03:37PM (#14547898)
Cool concept, but would require a complete revamp of our sessions infrastructure....I am looking to slap something on to our codebase to check email formatting after the '@' symbol.
Re:Ask HN: What is the norm for email validation? by 19eightyfour on Wednesday June 14, 2017 @04:09AM (#14551326)
The Firefox browser source code has a list of current TLDs, IIRC. There's over a thousand. You could use that to at least verify the TLD part.

The following may not work for your use case and I'm no expert in the area, but it could be possible to write a simple shell script to dig the mx records, and fail out if there's no such, and if you wanted to go a step further, you could open SMTP, and fail out if you can't, and if you wanted to go a step further you could even on the mx maybe even do a direct ping or some other lookup of the address part in that session, so long as the server is not a catchall. I feel the total bandwidth outlay would be no more then a small http roundtrip. Tho you might get a bit of hit on the connection time, or retries, as my feeling is not all SMTP hosts are speedy. Thanks