🛡️ Idea: Securing User Email Addresses from Bots & Potential Data Leaks

[Vianpyro]

Hey team! 👋

I’ve been thinking about ways to enhance security and protect user email addresses from bots and potential data leaks. Since we currently require users to register with their university email addresses, we can implement a mechanism to make this data harder for attackers to misuse.

---

🔑 The Idea:

To protect email addresses:

1. Domain Verification during Registration:

   • When users sign up, we’ll verify their email domain (e.g., .mit.edu) through the API to ensure they belong to a supported university.
   • The list of verified domains will not be stored in the database, but instead kept in a .env file. This means the domains will not be part of any potential data leaks, making it harder for attackers to determine valid domains.

2. Per-University API/Database:

   • Each university will have its own API or database to handle registrations. This ensures we can confidently validate domains and handle registrations specific to each institution.
   • By separating the API/Database per university, we add a layer of security and granularity to our approach.

---

🤔 Considerations:

1. Scalability:

   • Managing a .env file for domains is straightforward for a few universities, but how do we handle it as more universities join?
   • Can we implement an admin interface to manage these domains securely in the future?

2. Data Separation:

   • With each university needing its own API/Database, we’ll need a robust architecture to avoid complexity while maintaining security.
   • Should we develop a unified structure with isolated access for each university?

3. User Experience:

   • How can we keep the sign-up process smooth for users while ensuring robust domain verification?
   • Should we allow users to suggest their domain during registration (pending admin approval)?

---

💡 Benefits:

• Better Protection Against Data Leaks: Even in the case of a data breach, attackers won’t easily deduce valid email domains or addresses since the domains are stored in a .env file, not the database.
• Increased Security for Users: Adding domain verification ensures only authorized users can sign up while reducing exposure of sensitive email information.
• Flexibility for Future Growth: By isolating APIs/Databases per university, we ensure a scalable approach to handle more institutions.

---

🔄 Next Steps:

• Feedback: What do you think of this idea? Are there better ways to secure user email data?
• Technical Planning: How can we structure the API/Database setup to balance security, scalability, and ease of maintenance?
• Implementation Plan: If everyone agrees, we can begin outlining a roadmap for this feature.

Let’s work together to keep SyncUp secure and user-friendly! 🚀

---