1555
I'm locked out of my 6 year old Chipotle account because they now say my email address is invalid when I login. Here is me asking for their help: (lemmy.world)
submitted 2 years ago by to c/mildlyinfuriating@lemmy.world
278 comments fedilink hide all child comments
 

I also reached out to them on Twitter but they directed me to this form. I followed up with them on Twitter with what happened in this screenshot but they are now ignoring me.

you are viewing a single comment's thread
view the rest of the comments
[–] 328 points 2 years ago (46 children)

When you insist on implementing your own email address validation...

  • permalink
  • fedilink
  • source
  • hideshow 46 child comments
    •
  • [–] 172 points 2 years ago (17 children)

    I have my own domain that uses a specific 2-letter ccTLD - it's a short domain variation of my surname (think "goo.gl" for Google). I've been using it for years, for my email.

    Over those years, I have discovered an astonishing number of fuckheaded organisations whose systems insist I should have an email address with a "traditional" TLD at the end.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 17 child comments
    •
  • [–] 87 points 2 years ago (11 children)

    A few years back I bought a .family domain for my wife and I to have emails at ourlastname.family That lasted a week because almost every online service wouldn’t accept it. Now we have a .org

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 11 child comments
    •
  • [–] 44 points 2 years ago (6 children)

    Doesn't surprise me one bit. I've noticed that a lot of websites will only accept .com and a few will only accept email addresses from popular providers (Gmail, Hotmail, outlook, etc.)

    My guess is that it's trying to reduce spam and fake account generation.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 59 points 2 years ago

    My guess is that it's trying to reduce spam and fake account generation.

    Thus preventing the growth of any small providers and further entrenching Microsoft, Google, Apple, and a handful of others as the only "viable" options.

  • permalink
  • fedilink
  • source
  • parent
  • [–] -5 points 2 years ago (3 children)

    Yeah, that's it pretty much.Like 99% of your legitimate users are going to be standard gmail/yahoo/hotmail/etc. You see a user from ten minute mail, it's probably some shady shit.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 22 points 2 years ago (2 children)

    Not necessarily shady.

    I use 10 minute email if a merchant requires me enter an email account before seeing the total price on an item (including shipping). That's the most common pattern I've seen. My guess is that they want to ping you to complete the purchase.

    Or a website might require free registration in order to view the content.

    One place I use 10-minute email is actually Spotify. I didn't want to give them my Gmail address since your name is exposed to the world via their sharing API.

    Don't get me wrong, there are a lot of bad uses for it as well. But privacy minded people use it too.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 2 years ago (1 child)

    ELI5 the bit about spotify's sharing API?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 2 years ago

    When you share your playlist or have Spotify hooked up to some other service like discord, it shows the name associated with the account.

    And changing that name is not as straight forward as you might think.

    Given the fact that it's shared so easily, I wouldn't be surprised if email addresses could be exposed with the right options.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 2 years ago (3 children)

    I went with .io specifically for this. It doesn't look special or anything, it's just cheaper than .org and accepted anywhere I've tried, so far.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 8 points 2 years ago (2 children)

    What registrar do you use? Last time I checked .io domains where like 4x the price of a .org

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 17 points 2 years ago (1 child)

    Same. There are a lot of sites that just outright refuse to accept my email address that I’ve had for years, because it’s not a .com TLD.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 49 points 2 years ago (7 children)

    The only useful email validation is "can I get an MX from that" and "does it understand what I'm saying in that SMTP". Anything else is someone that have too much free time.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 33 points 2 years ago (6 children)

    It's easier to Google "email regex [language]" and copy the first result from stack overflow.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 22 points 2 years ago (15 children)

    I'm not aware of any correct email validations. I'm still looking for something accepting a space in the localpart.

    Also a surprising number of sites mess with the casing of the localpart. Don't do that - many mailservers do accept arbitrary case, but not all. MyName@example.com and myname@example.com are two different mail addresses, which may point to the same mailbox if you are lucky.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 15 child comments
    •
  • [–] 25 points 2 years ago (12 children)

    The only correct regex for email is: .+@.+

    So long as the address has a local part, the at sign, and a hostname, it's a valid email address.

    Whether it goes somewhere is the tricky part.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 12 child comments
    •
  • [–] 24 points 2 years ago* (6 children)

    Sorry, this is not a correct regex for an email address.

    Sending using mail on a local unix system? You only need the local part.

    STOP VALIDATING NAMES AND EMAIL ADDRESSES. Send a verification email. Full stop. Don't do anything else. You really want to do this anyway, because it's a defense against bots.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 5 points 2 years ago (1 child)

    I think it's fair to prevent users from causing mail sent to your internal systems. It probably won't cause any issues getting mail to the machine inbox for (no domain name), but it reasonably makes security uneasy.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 2 years ago (2 children)

    Yes, but no. Pretty much every application that accepts an email address on a form is going to turn around and make an API call to send that email. Guess what that API is going to do when you send it a string for a recipient address without an @ sign? It's going to refuse it with an error.

    Therefore the correct amount of validation is that which satisfies whatever format the underlying API requires.

    For example, AWS SES requires addresses in the form UserName@[SubDomain.]Domain.TopLevelDomain along with other caveats. If the application is using SES to send emails, I'm not going to allow an input that doesn't meet those requirements.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 6 points 2 years ago (1 child)

    Therefore the correct amount of validation is that which satisfies whatever format the underlying API requires.

    You mean the validation which the underlying API will perform on its own? You don't need to do it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 2 years ago

    I disagree. You should have validation at each layer, as it's easier to handle bad inputs and errors the earlier they are caught.

    It's especially important in this case with email because often one or more of the following comes into play when you're dealing with an email input:

    • You're doing more than sending an email (for ex, creating a record for a new user).
    • The UI isn't waiting for you to send that email (for ex, it's handled through a queue or some other background process).
    • The API call to send an email has a cost (both time and money).
    • You have multiple email recipients (better hope that external API error tells you which one failed).

    I'm not suggesting that validation of an email should attempt to be exhaustive, but a well thought-out implementation validates all user inputs. Even the underlying API in this example is validating the email you give it before trying to send an email through its own underlying API.

    Passing obvious garbage inputs down is just bad practice.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 16 points 2 years ago (4 children)

    Here's my address: @@@@@

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 6 points 2 years ago (3 children)

    And this right here is a great example of why simple basic RegEx is rarely adequate

    At the very least, should be something like

    ^[^@\s]+@([^@\s.]+\.)+[^@\s.]+$

    I'm like 99% sure I missed at least a few cases there, and will say "please don't use this for anything production"

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 4 points 2 years ago (2 children)

    Here's two: you can have multiple @s forming relays in an email address, and you can also break all the rules around dots and spaces if you put quotes around the local part, eg ".sarah.."@emails.com

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •