8
Have you seen the new browser Email Verification API? (resend.com)
submitted 2 months ago by to c/webdev@programming.dev
9 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 2 months ago (4 children)

Firstly, your browser accessing your inbox in whatever way is very dubious. Secondly, I'm not sure the "consent" part of the protocol would be implemented properly. I suspect Google would prefer a zero-click solution for their browser. This would mean that a website can theoretically iterate over all email accounts you are currently logged into by doing there verifications for different addresses in the background.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 2 months ago (3 children)

    I suspect Google would prefer a zero-click solution for their browser.

    You have to put in your email address and click a button still. There's a video demo of this in TFA. There's no way they've been dumb enough to let websites figure out your email address automatically, come on.

    your browser accessing your inbox

    Accessing your email via your web browser is literally how 99.99% of people use email. There's nothing dubious about it.

    I get that you have a gut fear about it though.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 2 months ago* (2 children)

    The point about zero-click flew over your head. After inputting your email address and clicking verify or whatever, your browser is meant to ask you for consent to check your inbox first. You can find that detail in the full API proposal. The video demo does not do this, which is why I claimed Google would probably omit this step and make the consent implicit :)

    However, at that point, the website can in fact check if you're logged in to a specific email address automatically. There is no need for user input. This can be abused by websites to link your identity, for example, if they suspect you are using two different email addresses for two different accounts.

    Also, there is a huge difference between the browser displaying your email inbox and the browser having autonomy over it in the background with no user interaction.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 months ago (1 child)

    Once the browser has discovered the issuer and knows that the user is logged in to the issuer, it is pretty confident that can provide an EVT, so it can choose to ask the user for permission. Each browser implementation is responsible for making their own judgement based on their user’s expectations, so this specification isn’t opinionated about how the interface with the user materializes.

    Google has likely chosen to make the permission prompt a one-time thing, which seems fine to me.

    However, at that point, the website can in fact check if you’re logged in to a specific email address automatically.

    It cannot.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 months ago*

    It cannot.

    I don't understand where your confidence is coming from, but I'd like to refer you to the proposal:

    https://github.com/WICG/email-verification

    3.1: The email selection is done through an <input> element. Populating this can be done programmatically.

    3.3: The verification consent is out of scope of the proposal, so it can indeed be completely missing.

    If you still disagree, then I frankly don't care. The mechanism behind this automatic verification is black-and-white and I've already outlined how it can and most likely will be abused by huge corporations.

    Edit: Well would you take a look at that; I'm not the only person seeing this issue: https://github.com/WICG/email-verification/issues/51

  • permalink
  • fedilink
  • source
  • parent