Comment by pmiller2 | Hacker News Reader

Comment by pmiller2 | Hacker News Reader

Parent Full thread

The sin here isn't not accepting "nonstandard" TLDs. It's that validating an email address is extremely hard to do correctly, and that you often really want to know if the person entering it has access to the address. The only way to do that is to accept pretty much anything that has an @ sign in the middle of some other characters, and then attempt to send email to that address with a clickback link.

The thing that really annoys me though isn't email address handling. It's credit card number and social security number entry fields.

For credit cards, the number of times you should have to specify which type of card you're entering is literally zero. All credit cards of the same type (e.g. Visa) begin with the same number sequence. Visa always starts with 4, so, if I type 4 as the first digit, just call it a Visa card. Do the Luhn checksum validation to make sure it's a valid number and that I probably entered it correctly, and try to run the charge. If it fails, then provide an appropriate error message.

For SSN fields, the thing that annoys me is that there are basically 2 common ways of entering the number: XXX-XX-XXXX and XXXXXXXXX. So many sites and apps only accept one of the two and will complain about the other. It's ridiculous, because the presence or absence of the dashes literally has no bearing on the validity of the number. Just let me enter it the way I want.

As long as we're ranting about stupid form design.

Dear everyone: Denmark does NOT have states. Literally dozens of times have I encountered a form that absolutely requires that I input something in the state field before they will ship my stuff. A sufficiently motivated individual could traverse the major landmasses of Denmark by bicycle in about a day[0], we don't need no damn states.

I usually put in "NULL" for state, and hope something breaks.

[0] https://map.krak.dk/m/oNdAL

Also, addresses in the country of Singapore do not have cities...

(Also, nowhere in the world except the US has "zip codes", and about 60 countries don't even have an equivalent postal code at all...)

> A sufficiently motivated individual could traverse the major landmasses of Denmark by bicycle in about a day[0], we don't need no damn states.

Well, that hasn't stopped similarly-sized Switzerland with 26 cantons. ;)

But, the cantons existed before there was a Switzerland. There's a reason its official name is "Confoederatio Helvetica." ;)

Ugh, try address fields. I mildly regret having moved to my current home last year, as inputting this address into forms is an impossible task. The "correct" address according to the formatting standards of my federal postal service, including street address plus unit number, is 47 characters long. I can put the UNIT number on the 2nd address line (when available), which makes the first line (just the street address) 37 characters long. I've come across more than a dozen services (Amazon, Apple, pizza places, etc.) that have length limits on address lines of between 25 and 35 characters.

The worst are the companies who (somewhat strictly, to varying degrees) verify the address of credit cards. I've barely managed to always verify by shortening into a grotesque form of the address that logistically makes no sense, but is apparently just close enough to match whatever fuzzy formula is used (eg. Levenshtein distance).

> I mildly regret having moved to my current home last year

I know what you mean for a different reason. Explaining that yes, my street name really starts with the word “Avenue” is getting really old.

FYI, Most credit card verification is just using the house number and the zip code. If there's no physical delivery, you can just put in Elm St or whatever.

https://en.m.wikipedia.org/wiki/Address_Verification_System

Sure, that all sucks, but, at least address handling is actually hard. Dealing with credit card numbers, even if you want to go beyond the basic Visa / MasterCard / Discover / American Express, isn't that hard. Neither is sanely dealing with SSNs (except that most uses of SSNs are insane by default, but that's just a matter of using it as an ID number when it shouldn't be).

I'm a fan of forms where they automatically add the dashes/spacing (for ssn and cc, respectively), so you don't have to guess if they're needed.

I don't think I've been able to enter them AND they've been necessary since the '90s though.

I was a fan of that until I experienced that they don't actually test the code. I've had it break in entertaining ways, most recently getting a new monitor from Dell and trying to enter a phone number (on Firefox on Android, both current & Preview) went like this for the number 123-555-1212, typed without dashes:

Enter number, result is: 125-535-2112 .

On the plus side it was predictable and I was able to eventually enter the number something like 2153552121 and have it appear on page as 123-555-1212. When I encountered this a second time a few days later (reordering due to DOA) I discovered pasting the entire number in allowed the 'automatic' nature to add dashes correctly.

The correct answer to me is to strip out non-numbers and then verify the number is a valid phone number (which should be easier than programmatically determining names or dates).

Yes! And it really is so easy to implement all of this validation and checking without it being too complicated. How is parsing some numbers and running a few math equations the source of so much trouble?

The only two explanations I can think of are ignorance and laziness. Ignorance doesn't really fly, IMO, because when you have an input field, you should be at least thinking about validating said input. From there, the simplest of google searches will lead you to the checksum algorithm.

Laziness seems most likely for that reason, but, on top of that, it's not like you even have to go to Stack Overflow to find an implementation. Wikipedia has one! Wiki. Pedia.

Just take my input, run the checksum, check that my expiration date isn't in the past and that the CVV value is the correct number of digits, and just run the charge. It's not like if I mistype my MasterCard's first digit as a 4 that it's going to work anyway. Just do the checks that are feasible, and then just run the charge.

> For credit cards, the number of times you should have to specify which type of card you're entering is literally zero

From what I can recall, the number of times I've had to specific what type of card I have when filling out an online form is zero, because every form I can remember using did autodetect it. I admit I'm fairly young (only have had a card for 10-12 years), but from the amount of frustration you seem to have about this, I feel like you must have run into it much more recently than that.

Reply on news.ycombinator.com