Hacker News Reader

Comment by throwawayboise | Hacker News Reader

I'm not an expert here, but I suppose that only processing emails that have pass all the SPF/DKIM/DMARC checks would help. This may be something your email server already does, before your app ever sees the emails.

Otherwise, requiring a digital signature doesn't seem like a huge usability hurdle to me, most email clients support this pretty routinely.

View on HN

That would be such a big hurdle for the average user. The risk is low and the subject(blog) makes this a low target.

Yeah I think it would be a little overkill. The unique email addresses are almost impossible to guess so you just need to make sure you don't share them with anyone.

Just thinking out loud here, what about having to attach a key as an attachment?

What kind of key? I am just afraid to make it "complicated" because now it's as simple as sending an email to some address. :)

You would provide this file for them to download alongside where you show the email address; the file would be equivalent to an API key - should be a symmetric key. It's sort of just swapping out an Authorization header for a file with an expected checksum/contents.

If the barrier is technical abilities, trying to set up public/private keys and/or signing the emails could hinder adoption.

I'll think about it. For me keeping things simple is a priority. What are the chances that a user might share the unique email address by mistake?

One more suggestion that would, IMO, be fairly simple. Tell the user to write in their subject line a {accessKey: 'someKey'}. The access key is given to them at the time of creation and can be regenerated as often, or rarely, as the user prefers. If they want update it weekly to provide an extra layer of security they can, or they could keep it the same forever with it just bein a handy backup in case they do link the random email. Just a thought.

For now I am taking notes but I need to think this through. I really don't want to compromise the ease of use :)

Make it simpler than GP — just allow people to cycle the unique email addy if they think they fucked up!

Cool thing, man.

Yep I've add that to my list. It's a small and quick change. Thanks! :)

Reply on news.ycombinator.com