How hard is it to implement email verification?

you are viewing a single comment's thread
view the rest of the comments
[–] 37 points 4 months ago (5 children)

If you log in with social media, they get more than your email address. Data mining.

  • source
  • hideshow 5 child comments
  • [–] 28 points 4 months ago* (last edited 4 months ago) (4 children)

    They do not, normally, unless you specifically allow that. Yet, indeed, many services enable/require quite permissive scopes by default.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 23 points 4 months ago (2 children)
  • [–] 4 points 4 months ago (1 child)

    per oauth spec you get told what is shared. usually it's just your user id (which often is email or username), i haven't seen crazy scopes in the wild in a while

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 4 months ago

    Some services even have an option to only share a dummy email and not your real. Apple for example does this, so all the site gets is "36382618161@apple.com" (don't know the exact format). And it is only tied to your real email address on apple's side

  • source
  • parent