Email Verification Tagged As Junk Mail

[Andrew McGreevy]

Just flagging up that my Persona email verification got tagged as Junk Mail in Apple Mail

[Marcio Galli]

This is a very important discussion I think. I understand that some
folks think that this is outside the scope (perhaps it's my old self
last year) but now I tend to think that it's all connected and
important for us to understand all the nuances.

I like your question, and wonder how it was tagged under junk, but I
ask all of us to use this to expand this discussion:

* What are the cases e-mail from Persona could fall in junk
* What are the complexities for users to understand the "e-mail cycle"
* What other alternatives could we create in the future (only e-mail? )
* Could an user start the Persona (first time) from an e-mail
initiated from the user?
* What related problems other companies have faced in the past
* Security problems with e-mail

To throw some points...

m

On Mon, May 20, 2013 at 7:04 AM, Andrew McGreevy <dr...@venturesoft.co.uk> wrote:
> Just flagging up that my Persona email verification got tagged as Junk Mail in Apple Mail

> _______________________________________________
> dev-identity mailing list
> dev-id...@lists.mozilla.org
> https://lists.mozilla.org/listinfo/dev-identity



--
www.telasocial.com

[Francois Marier]

On 21/05/13 04:15, Marcio Galli wrote:
> * What other alternatives could we create in the future (only e-mail? )

The reason why we send an email out is that through the fallback
identity provider, we are signing a certificate on behalf of the email
provider which essentially says "we know that this user controls this
email address". So we do need to verify that the user can receive emails
at that address before we make that claim.

Going forward, we hope that most users will be able to use an email
provider with native Persona support (or identity bridging) to avoid the
email loop.

> * Could an user start the Persona (first time) from an e-mail
> initiated from the user?

In order for this to work, we would need the user to send us an email
that's cryptographically signed with a key that we trust. Maybe that's
something that DKIM can help with, but I'm not sure how much we can rely
on it for this purpose.

Francois

[Arvind Gupta]

Hi Andrew
It's not the case in gmail.

[Jared Hirsch]

Thanks for letting us know, Andrew. As we move our stack to AWS we'll be
very likely to switch SMTP providers to the thing Amazon provides (SES I
think? so many three-letter service acronyms in AWS), so I'm hoping we'll
see improvement in throughput, latency, and reduced failure rate.

This is likely to happen sometime in the next few months, after we've moved
away from physical hardware totally. Stay tuned :-)

On Mon, May 20, 2013 at 3:04 AM, Andrew McGreevy <dr...@venturesoft.co.uk>wrote:

> Just flagging up that my Persona email verification got tagged as Junk
> Mail in Apple Mail

[Andrew McGreevy]

Great! Am using SES for email verification on a few of my web apps. and had
no problems so here's hoping :)

--

Mr Andrew McGreevy
venturesoft <http://www.venturesoft.co.uk/>®
Venturesoft Limited is Registered in England and Wales at Companies
House. Company No: 6618384

Registered Office: 32 Spring Street, Chipping Norton, Oxfordshire,
United Kingdom