Hacker News Reader

Comment by bobjordan | Hacker News Reader

Thanks, just spent five minutes modding my webapp to disallow email aliases.

That has to be the worst idea of the year. You are essentially blocking perfectly valid emails on the assumption that one single email provider uses the + character with some special meaning. Congratulations, that's how you break the internet.

I will call support to notify them my e-mail (with a + in it) isn't working, like I have done before. No I don't have another e-mail address. Yes, this is really my e-mail address.

To be fair, I would assume/hope the implementation is gmail specific and just truncs the + part only when doing uniqueness validation. Granted its effectiveness is small.

This would not account for emails which have a custom subdomain but are still hosted by gmail, which will behave the same way as gmail with respect to the "+" sign (I've seen many universities do this).

That is essentially losing 1 customer vs handling thousand spammers.

Except people use aliases to protect themselves from spammers - who frequently buy or steal e-mails from companies like the one you're considering.

Then better alternative would be to develop a unique mail check functionality ignoring the + part. Maybe that could work for both sides.

When I helped my grand parents set up GMail they decided that they wanted one shared email account instead of one each. That has worked very well for them. Old people have enough to keep track of already so a shared email inbox for the both of them is great. My grandfather uses the GMail web app on his Mac desktop and my grandma uses the GMail app for iOS on her iPad.

However, when I set up Apple ID for each of them I wanted to create separate Apple IDs for each of them.

Thankfully Apple does not do anything like ignoring the + part you provide.

There are many ways spammers can create any number of email addresses.

Ignoring the + part of email addresses isn’t going to stop spammers, but it is going to cause a lot of pain for regular users because the + part has many applications that you can’t even imagine.

When the user hands you an email address, use that email address as is. Don’t ignore the + part of GMail addresses or anything like that.

Thank you for nice explaination, it changed my mind to worry less.

When a website presumes to normalize my Gmail address, I presume they aren’t interested in my money.

You are well within your rights to prohibit duplicate signups from the normalized address, but please don’t presume to replace what the user entered.

Kind of a slap to anyone who uses email aliases to sort/filter email

I use aliases to filter my email and also to see who sells my email address to third parties. All the websites I've used allow "+" in the email address so that's good.

You can assume that the companies selling off email data are smart enough to do the entirely trivial "remove + sign to @ sign" transformation for gmail addresses, at least partly because their job tends to be tracking you across a large amount of domains.

I switched to mails under domain I own (and powered by FastMail) some time ago; I now use alias@username.mydomain form. Try to filter for that without breaking non-aliased e-mails!

By that point you might as well set a fixed-width length and treat everything after that as an alias, like me@domain.tld would be the base and mespammers@domain.tld would be your alias for spammers.com, etc. Even better, put the alias before the username and keep the + as a separator.

Come to think of it, I bet doing this actually gives them better signals than they'd otherwise get, because if they receive emails by word of mouth, then they get additional context as to what sites you're signing up to.

You may want to allow email aliases, but ignore the 'alias' part when checking for uniqueness.

Please don't. It's an important feature for a lot of people (me included).

Just ignore it when checking uniqueness, if you really must

The problem is that you are no longer compliant with the email spec: https://tools.ietf.org/html/rfc5322#section-3.2.3

Does nobody read RFC’s anymore?

> Does nobody read RFC’s anymore?

I did, before posting my answer, though I admit I was too lazy to look up the email RFC and instead just used the URI RFC and assumed the allowed characters in the user-name would be the same :P

I'd reconsider this change. Lots of people use email aliases to track which sites share their contact details with third parties. I see it all the time in signups for one of my sites - don't mind, of course, because I don't share their data. If you stop people doing this it might send the wrong message.

This is a poor way to track who is selling your contact details. It's trivial to strip + aliases from a list.

But it's a good way to track who accidentially leaked your contact details.

Unless the receiving party strips them as a matter of deliverability of their spam.

That's downright silly and a user hostile move, IMO (why at all wouldn't you want someone to test things out without having to give one of their main email address?). Your solution seems to assume that everybody uses only Gmail and Gmail plus addressing. Gmail also considers dots/periods in addresses as not existing. Try blocking those too (no, actually don't try this!). There are so many temporary or disposable email services that you'd be wasting your time trying to disallow all those. Your time could instead be better spent on making your product or service more attractive to paying customers.

Excellent work. Now disallow catch-all email addresses. I'll wait.

Well surprise, I actually use that feature in real life with my real email.

It is really helpful if you want multiple profiles for a service (ex. Different mode, different recommendation) or in filtering all emails sent to that specific address (can't filter with the "from" as I don't know who is emailing me)

Please don't break standards

But, then you are not complying with standard email, are you? See https://tools.ietf.org/html/rfc3696#section-3

I use an alias for every website, like me+apple@gmail.com to login to Apple.

Sounds like busywork without appreciable gain

Until you take a look at your spamfolder to see who's been selling you e-mail address.

most spammers use bcc, no?

Not the ones that are in my junk folder currently.

Not sure of your app, but what do you care if multiple people share the same inbox? They can always with something like Mailinator or other domain-level aliasing.

Revert that change. Just like DRM is easily defeated, so is your webapp's alias check, one can simply buy a few cheap domains and your checks fail.

Great marketing for your services since you're putting them in your profile.

Reply on news.ycombinator.com