A better way of validating an email address
alentodorov.posterous.com
alentodorov.posterous.com
All of these are the kind of people you want using your service or software: clueful and security conscious. When they recommend something, people listen. As customers, they're less likely to ask a FAQ and more likely to point out an actionable bug or deficiency.
The only problem I have with 'click-to-confirm' email messages is that some services deliver them slowly. If you can fire off an email when I click Register, I can be reading it and cutting-and-pasting the URL or ID code five seconds later. A message that doesn't arrive for ten or fifteen minutes means I have to context-switch away and then back.
Technically nothing has been validated. You've proved that the email address exists. But it's deliberate use hasn't been validated. And that's the whole point of validation.
If people do insist on using this method, they should at least add a prominent link to cancel the account in the e-mail.
But what if some random e-mail client prefetches the image and the e-mail end up never being read or whatever? This is not robust.
The whole point of not loading images is the privacy concern, so if your email client (which is any email client with any kind of traction in the past decade) offers (and defaults to) not loading images, it will indeed not hit the URL.
I'm not sure this is accurate, this link is a little old but it indicates quite a few webmail/desktop clients load images by default: http://www.campaignmonitor.com/blog/post/2559/current-condit...
Perhaps "decade" was too generous a word to use. Certainly any client that has traction today defaults to not loading images. Now, that certainly doesn't mean that there are no clients that does this, and that no-one changed that setting.
That the possibility for an email client to be so configured that it would AUTOMATICALLY process a false positive validation, makes this system utterly unusable for any developer with a [brain|conscience].
If the purpose of the validation is simply validation, then what you call a false positive isn't actually false, as the e-mail address evidently was valid.
Including a very clear "I did not ask for this" link in the e-mail would allow false positives to undo any damage done.
Just because a technology can be used for bad (and this one is indeed - anyone auto-loading images in e-mail will be flooded with spam for that exact reason) it does not imply that any use of the technology is bad.
I can think of three reasons you want to validate an e-mail address like this:
- Confirming that you've typed your e-mail address correctly and that it is reachable
- Preventing you from impersonating someone else
- Opt-in for sending you e-mails. Not really to prevent you from spamming/harassing/annoying someone else (there are many ways other ways to do this), but to prevent the service from having e-mails marked as spam.
I'm sure the last one is the strongest, as being blacklisted from one of the big e-mail providers would really hurt most online services.