Hacker News Reader

Hacker News

Comment by znpy | Hacker News Reader

Parent Full thread

znpy

I've come to appreciate DigitalOcean's approach on the matter.

Until you configure a 2FA device (TOPT in my case) they'll send you a temporary code to your email address.

So password alone is worthless, and mailbox ownership is verified on every login.

Also, I made a point never to use the "login with X" feature, no matter what X is.

I always sign up with my own email.

View on HN

I really hate the "we're going to send a code to your email" approach because it so often breaks.

Case in point, I tried to log into Patreon earlier today, they insisted on sending a code, and it never arrived. I tried several times, no email. I have a record of every email sent to my address for the past several years regardless of spam status so I can be 100% positive they simply never sent it.

In the end I had to give up. I can't log into Patreon today, because of their insistence on sending me an email even though I'm logging in from a computer I've used many times before.

I'm curious -- do you host your own email, or use a lesser-known email provider?

I am increasingly seeing failures where sites seem to be blackholing outgoing email, I suspect based on the destination domain, and unaware that they are even doing this / extremely insistent that they are not. I've gotten login-email failures like you describe from a couple of sites, and seemingly similar failures from those "email your kid this story" sharing systems on two news sites my mother uses. In all these cases, the messages simply never arrive at the destination SMTP server.

Patreon has had many outages in the last few weeks, typically for 30mins to 2hours at a time.

The outages have been affecting their authentication (login and sending emails) as well as the API.

Their status page is also very slow to update. This shows a fraction of the outages that myself and others have experienced. https://status.patreon.com/

I have a custom domain that uses Gmail as its mail provider (for legacy reasons related to the other users of this domain), and my Gmail account is configured to never mark anything as spam and to forward everything to Fastmail. This means that no matter what I do with my email, I can log into the gmail account and see every email I've received for years sitting in my inbox.

I don't really recommend this setup, I'd really prefer to cut Google out of the path entirely, but I can't do that without abandoning my email address.

Gmail and most other providers will 5xx incoming mail they see as spam before it even gets to your spam settings. It's a "feature" on their end to outright block more blatant spam, but it often snags larger senders of legitimate email. Like Patreon.

If it’s catching Patreon then Patreon must be doing something really egregiously wrong, because there’s tons of spam I get to my address that’s exceedingly obvious. And I have no problem receiving other email from Patreon, so I think Patreon really just failed to send the login code email.

I've had this issue with some websites that use transactional e-mail services to send their e-mails. A temporary failure on your domain or email provider will flag the address as bad seemingly permanently on their e-mail provider's side so that it will instantly fail any future sending attempts to that address even after the original issue is resolved.

I host my own email but I'm not having any problem with digital ocean's mails.

I would agree except I always had issues where I would never receive their TOTP emails. I was using Fastmail and had my spam settings set very leniently.

Fastmail Support claimed they never received any mail (ie it hadn't bounced) but DigitalOcean Support would insist I check my spam folder for the 500th time.

Ultimately, I just swore to never use their services, primarily because I... could never log in and actually use their services.

I think it's fixed nowadays but I wasted so much time on that issue.

Reply on news.ycombinator.com