Hacker News Reader

Comment by thephyber | Hacker News Reader

I don’t get the argument that the email dots stripping should be removed but the “+” tag feature should be kept.

Both of them allow infinite email addresses. The tag feature is not always available because app developers frequently don’t allow the plus character.

I would prefer that (1) a Netflix require email verification and (2) GMail describe in detail all of the email address features so app developers can explore the security issues around them.

I used to work for a company that dealt with these issues almost 10 years ago. It was also fun when Hotmail and Yahoo started recycling unused email addresses after ~6 months.

View on HN

> The tag feature is not always available because app developers frequently don’t allow the plus characte

Should we stop using a feature because some buggy apps don’t support it?

This is why, on my semi-personal (<10 users) email server I process several different characters as tagging characters: dot, dash, underscore, and plus IIRC.

I use a subdomain as catch-all; *@something.example.com all goes to one folder. That way it's impossible for the spammers to know that this is a "sorted" e-mail address since lots of people have e-mail addresses under a subdomain and it's not trivial to filter out like myrealidentity+youareaspammer@example.com turning into myrealidentity@example.com.

Other users on my setup can use it, they just have to pick a different "something" if they want to use the same example.com as me.

I must be missing something but the + and . feature both have the same problem for this "scam", right?

Right. Which is exactly what the GP said.

a dot looks way less suspicious to a non-technical user. a plus is more jarring, and more likely to incite suspicion.

I'd say most "non-technical" users dont even look at the email address it was sent to. They just assume that since it landed in their inbox, the magic 'computer' knows what its doing and they just need to read their email and reply appropriately.

My understanding is + sign is in the RFC, so of course it should be supported. If you want to identify your users by email, you should probably strip the + and everything after before checking for uniqueness. On the other hand, dots matter in the RFC and Gmail is breaking it with their "feature".

edit: I was corrected in other comments that the + labeling is optional part of the standard.

> I was corrected in other comments that the + labeling is optional part of the standard.

Allowing + in emails is not an optional part of the standard.

> you should probably strip the + and everything after before checking for uniqueness.

No, you shouldn't. Different email providers use different characters to allow "subaddressing" or "tagging" and the presence of those characters doesn't mean that any subaddressing will be done.

https://en.wikipedia.org/wiki/Email_address#Subaddressing

Gmail isn't breaking anything. It's none of Netflix's business that Gmail gives its users aliases. This issue has nothing to do with dots, and everything to do with Netflix sending bills to unverified email addresses.

As far as I can tell it isn't in the standard at all, optional or otherwise (although the character '+' is allowable). Gmail are not the only ones to implement this feature though.

Also, you'll have to elaborate on how the dot usage actually breaks the RFC. I assume it states that dots are just like any other allowable character, but that's not the same as actually breaking the RFC.

Reply on news.ycombinator.com