this post was submitted on 26 Aug 2026
9 points (100.0% liked)
Web Development
5794 readers
33 users here now
Welcome to the web development community! This is a place to post, discuss, get help about, etc. anything related to web development
What is web development?
Web development is the process of creating websites or web applications
Rules/Guidelines
- Follow the programming.dev site rules
- Keep content related to web development
- If what you're posting relates to one of the related communities, crosspost it into there to help them grow
- If youre posting an article older than two years put the year it was made in brackets after the title
Related Communities
- !html@programming.dev
- !css@programming.dev
- !uiux@programming.dev
- !a11y@programming.dev
- !react@programming.dev
- !vuejs@programming.dev
- !webassembly@programming.dev
- !javascript@programming.dev
- !typescript@programming.dev
- !nodejs@programming.dev
- !astro@programming.dev
- !angular@programming.dev
- !tauri@programming.dev
- !sveltejs@programming.dev
- !pwa@programming.dev
Wormhole
Some webdev blogs
Not sure what to post in here? Want some web development related things to read?
Heres a couple blogs that have web development related content
- https://frontendfoc.us/ - [RSS]
- https://wesbos.com/blog
- https://davidwalsh.name/ - [RSS]
- https://www.nngroup.com/articles/
- https://sia.codes/posts/ - [RSS]
- https://www.smashingmagazine.com/ - [RSS]
- https://www.bennadel.com/ - [RSS]
- https://web.dev/ - [RSS]
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Seems reasonable to me. What are you imagining will go wrong?
Firstly, your browser accessing your inbox in whatever way is very dubious. Secondly, I'm not sure the "consent" part of the protocol would be implemented properly. I suspect Google would prefer a zero-click solution for their browser. This would mean that a website can theoretically iterate over all email accounts you are currently logged into by doing there verifications for different addresses in the background.
You have to put in your email address and click a button still. There's a video demo of this in TFA. There's no way they've been dumb enough to let websites figure out your email address automatically, come on.
Accessing your email via your web browser is literally how 99.99% of people use email. There's nothing dubious about it.
I get that you have a gut fear about it though.
The point about zero-click flew over your head. After inputting your email address and clicking verify or whatever, your browser is meant to ask you for consent to check your inbox first. You can find that detail in the full API proposal. The video demo does not do this, which is why I claimed Google would probably omit this step and make the consent implicit :)
However, at that point, the website can in fact check if you're logged in to a specific email address automatically. There is no need for user input. This can be abused by websites to link your identity, for example, if they suspect you are using two different email addresses for two different accounts.
Also, there is a huge difference between the browser displaying your email inbox and the browser having autonomy over it in the background with no user interaction.
Google has likely chosen to make the permission prompt a one-time thing, which seems fine to me.
It cannot.
I don't understand where your confidence is coming from, but I'd like to refer you to the proposal:
https://github.com/WICG/email-verification
3.1: The email selection is done through an
<input>element. Populating this can be done programmatically.3.3: The verification consent is out of scope of the proposal, so it can indeed be completely missing.
If you still disagree, then I frankly don't care. The mechanism behind this automatic verification is black-and-white and I've already outlined how it can and most likely will be abused by huge corporations.
Edit: Well would you take a look at that; I'm not the only person seeing this issue: https://github.com/WICG/email-verification/issues/51