我需要担心移动应用程序上的垃圾邮件吗？
我想知道垃圾邮件发送者是否有能力像网络应用程序一样下载、抓取和发送垃圾邮件移动应用程序。更具体地说，是否有必要像 Web 应用程序那样对用户进行身份验证？ （即发送到用户电子邮件的验证码或验证链接）
您可以提供的任何见解，甚至是有关此主题的其他信息的链接，我们将不胜感激。谢谢！
另外，这里有一些更具体于我的场景的信息，以防有帮助：
我有一个现有的网络应用程序，目前正在编写 iphone/android 应用程序作为网络应用程序的扩展。 Web 应用程序和移动应用程序使用相同的数据库信息。
在我的网络应用程序中，我要求用户在填写“创建帐户”表单后单击电子邮件中的链接来激活他们的帐户。但是，我希望用户也能够在移动应用程序上创建帐户，但绝对不希望他们必须退出应用程序才能检查电子邮件以单击链接。理想情况下，他们可以在移动应用程序上创建一个帐户并立即开始使用它。
我担心的是，自动垃圾邮件机器人可能会在没有对移动应用程序进行任何验证的情况下创建虚假帐户，从而向网站发送垃圾邮件。任何登录用户都可以添加每个人都可以查看的内容。因此，即使 Twitter 等网站允许用户在其移动应用程序上创建帐户并在验证电子邮件地址之前开始使用它，但如果垃圾邮件机器人能够下载我的应用程序、创建帐户和发布内容，那么我需要寻找另一种方式。
I would like to know if spammers have the capabilities to download, crawl and spam mobile apps like they do for web apps. More specifically, is it necessary to authenticate users to the extent that web apps have to? (i.e. captchas or verification links sent to user's email)
Any insight you could provide or even links to other information on this topic would be much appreciated. Thanks!
Also, here is some information more specific to my scenario in case this helps:
I have an existing web app and am currently writing iphone/android apps as an extension of the web app. The web apps and mobile apps use the same database information.
In my web app, I require users to click a link in their email to activate their account after they fill out a "create account" form. However, I would like users to be able to create an account on the mobile app as well but definitely don't want them to have to exit the app to go check their email to click on a link. Ideally, they could just create an account on the mobile app and start using it right away.
My fear is that automated spam bots could create false accounts without any verification on the mobile apps and thus spam the site. Any logged in user is able to add content that is viewable to everyone. Thus, even though sites like Twitter allow a user to create an account on their mobile app and begin using it before verifying the email address, if spam bots have the capability of downloading my app, creating accounts, and posting stuff, then I need to find another way.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
从应用程序发送垃圾邮件应该是不可能的，或者至少是不明智的。至少对于 iPhone，您必须拥有一台已越狱的 iOS 设备才能运行每个 Spambot。听起来太贵了。
至于Android，理论上是可以的，但目前可能性不大。我建议一开始就不要激活，只是稍微观察一下该网站。无论如何你都应该这样做。
我们为社交网络应用程序所做的就是允许第一个（但仅是第一个）会话，并要求激活所有后续会话。
Spamming from the App shouldn't be possible, or at least not sensible. At least for iPhone, you would have to have a Jailbroken iOS device per Spambot you want to have running. That sounds too expensive.
As for Android, it would theoretically be possible, but not very likely at the moment. I would recommend going without activation in the beginning and just watching the site a little. You should be doing that anyway.
What we do for our Social Network Apps, is to allow the first (but only the first) Session and require activation for all successive Sessions.
无论机器人是否能够下载您的应用程序，如果有人愿意，他们都可以自己下载您的应用程序，然后开始创建垃圾邮件帐户。然后，这些帐户可能会被您的网络应用程序上的垃圾邮件发送者机器人使用。您应该保持与现在相同的安全模型。
开发人员允许移动注册的一种相当流行的方式是将用户发送到您的网站进行注册。这样，您就不必担心将安全性复制到多个移动应用程序中。
Regardless of a bot's ability to download your application, if someone wanted to, they could download your app themselves then get to work on creating spam accounts. These accounts could then be used by the spammer bots on your web-app. You should keep the same security model that you have now.
A fairly popular way that developers allow for mobile sign-up is to send the user to your website to sign up. This way, you don't have to worry about duplicating your security into multiple mobile apps.
至少使用更安全的 HTTPS 来创建应用程序的帐户，否则有人可能会嗅到您的协议并模仿它。
At least use more secure HTTPS for your app's account creation, or else someone could just sniff your protocol off the air and imitate it.
我发现这家公司（http://www.pindropsecurity.com/）为移动应用程序提供安全性。大多数应用程序（尤其是消息传递和营销应用程序）都要求您添加电话号码才能创建帐户。如果垃圾邮件发送者输入与垃圾邮件/欺诈活动相关的号码，他们就能够将其全部阻止。许多应用程序和营销公司都在采用它。
I found this company (http://www.pindropsecurity.com/) which provides security for mobile apps... Most apps (especially messaging & marketing apps) require you to add a phone number in order to create an account. If the spammer puts in a number that is associated with spam/fraud activity, they are able to block it all together. A lot of apps and marketing companies are picking it up.
我认为唯一能回答这个问题的人就是垃圾邮件发送者本身。然而，考虑到垃圾邮件发送者/黑客似乎与技术保持同步，我想说，他们找到向您的应用程序发送垃圾邮件的方法（如果他们还不能）只是时间问题。
I think the only people who can answer this would be the spammers themselves. However, given how spammer/hackers seem to keep up with technology, I would say it's only a matter of time before they find a way to spam your app, if they can't already.