I thought that some of you might be interested in a bit of writing I've been doing elsewhere.
Firstly, on my blog I've written a couple of short pieces about common mistakes that companies make when interacting with customers over the internet.
And secondly I've written a couple of tech book reviews:
Surely the first occurrence of "address" shouldn't be there?It's incredibly rude to send an email address from an email address that won't accept replies.
Re:Is this a typo?
davorg on 2005-12-15T13:24:23
You're absolutely right. And I've fixed it now.
I need better copyeditors:)
Re:Is this a typo?
jdavidb on 2005-12-15T18:29:27
Similar:
I think you meant "anyone can intercept the email."
Also, it was not apparent to me why the second option was less secure until I read rule 2. It was news to me (welcome news) that option 1 could be made more secure by leaving out the user name. You might want to reorder or reword things to make this more notable, because I'm betting a lot of otherwise perfectly competent people haven't realized this, and won't be thinking about it at the time that you remark on the difference in security.
Of course, for the ultimate in security, your users should upload a public key during registration. Then you can send their password encrypted with their registered public key, perhaps to any email address they specify. This even overcomes the problem of users who have changed email addresses and have no access to the old address! But I expect it will be a long time before this approach becomes common, let alone regular.
Re:Is this a typo?
jdavidb on 2005-12-15T18:30:29
I was going to name and shame the site that I dealt with this afternoon, but I wrote them a polite email explaining the problems and in less than 45 minutes I got a reply saying that these problems had already been noted and that they should be fixed by the end of the week. That's pretty good customer service so I won't embarass them by telling everyone who they are.
Oh, and I think you should name and praise them, assuming this is actually fixed!
Re:Is this a typo?
bart on 2005-12-16T12:35:06
I saw that too, after I posted my comment here.
It looks like davorg has a thing for the phrase "email address" when he just means "email".:)
