Hacker News Reader

Comment by r3bl | Hacker News Reader

Something that came into my mind after reading this:

Let's say your name is Jon Doe and you've purchased domain.tld that was previously-used by some company. So you create to yourself jon@domain.tld, and figure out that the previous owner had an employee named Jon that used it as a primary or secondary email across dozens of most popular services.

How the hell do you proceed with your account creation?

The entirety of the web is built on the notion that email addresses are unique, but there are multiple cases in which that might not be the case. What are your options then? jon2@domain.tld?

View on HN

Hotmail addresses used to expire after a period of inactivity lol. I pranked one of my high-school buddies by re-registering his old email. At first he was just very confused, then I realised he had probably used that address as a recovery email for a bunch of stuff, and was able to recover passwords for his new email address. Lucky for him I'm not the kind of person to take a joke too far.

Reset password, delete account, then create a new one?

Not all services make it easy to delete accounts, and even in some cases because they soft-delete stuff (let's not get into the problems with that), you still can't use an email that was previously used.

Change the email address for accounts you can't delete to jon2@

Add a tag:

    jon+servicename@domain.ltd

If the service will accept that of course. It's perfectly valid, and you'll know if it works when you get the confirmation email.

While common, I don't think this is a standard, so it will vary by service provider or email server. According to spec, "+" can be a valid part of an email address:

    Without quotes, local-parts may consist of any 
    combination of alphabetic characters, digits, or any of 
    the special characters

        ! # $ % & ' * + - / = ?  ^ _ ` . { | } ~

https://tools.ietf.org/html/rfc3696#page-5

As far as the service is concerned, that's simply an entirely different email address. You might as well do shabadoo@domain.tld. Since you control domain.tld, you can of course receive any email sent to it.

But the point the GP was making is that email addresses are treated by services as if the will always be tied to the same person, but that's simply not true.

I’ve had many experiences where one day a site will stop handling + correctly and I can no longer sign into my account. More common is the registration form allows + but the sign in does not, or I can subscribe to an email newsletter but not unsubscribe.

This only works with Gmail, and copycats

I worked for a conglomerate a few years ago but had a simple email. I realized my email was recycled after I started receiving all kinds of unusual emails... like emails for an old personal eBay account. It was funny at first, but it was definitely a security liability for himself and the company as I was occasionally sent emails I'm sure I should not have been included on (he was a higher level, and was part of several mailing lists that were not purged after he left).

Reply on news.ycombinator.com