Hacker News Reader

Comment by 1024core | Hacker News Reader

Back when I was single, I was on a dozen dating sites. It was frustrating as heck to keep getting led on by fake profiles.

eHarmony is the worst: they actually sold my email address to spammers. How do I know this? I have my own domain, and use a unique (hard to guess) email address for each site I have to give an email address to. So it was trivial to nail eHarmony as the culprit.

Someone has already linked to the OKCupid blog post which explained pretty well why you should not pay for a dating site. Then they were bought out by Match (how did the anti-trust people let Match accumulate so many sites?), and any principles they had went down the drain.

Basically, the market is ripe for a respectful dating site. But OKCupid started this way; and in the end they sold out. What makes you think you won't sell out when the money is right?

View on HN

eHarmony is disgusting. Or they were, the one time I tried to use their service ten years ago.

My wife and I had been separated for a while and in the divorce process. (We were and remain on friendly terms, but it was definitely over.) I thought I would check out some dating services, and eHarmony sounded like one that wasn't sleazy or weird.

So I filled out their lengthy multipage onboarding form, with all kinds of personal questions where they ask you to write heartfelt essays about various things.

At the beginning they asked my marital status and went on from there through the whole questionnaire. After I entered all of my information and wrote my personal essays, they got to the last page and said:

"Sorry! We don't serve your kind. You are separated! Come back when your divorce is final."

Those weren't the exact words, but that was the message.

Now if a dating site wants to serve only a certain market, and if they don't want to serve people who are separated but not yet fully divorced, I totally respect that! But they need to say it up front after asking your marital status.

Instead, they led me through the entire questionnaire, asking all sorts of personal questions, without even a hint that the very first question about my marital status was going to disqualify me.

And then they offered no way for me to recover any of the information I had just entered into their site: all the essays, personal questions and answers, all gone.

No online service of any type, dating or whatever, should ever do this to anyone.

Luckily, I'd had the sense to copy and paste all my little essays into a text file and not trust them to give them back to me. That just seemed like common sense. But in the case of eHarmony, it was necessary!

>And then they offered no way for me to recover all of the information I had just entered into their site - all the essays, personal questions and answers, all gone.

What's worse is that they probably saved it and profited from that data.

In my market, eHarmony pretty blatantly advertises itself as the morality police type of Christian platform - so this sort of thing is implied.

Yes indeed, and I have no problem with their choice to serve only those who fit with their mission.

If they had only been honest and up front about it, and as soon as I said I was "separated" they said "sorry, we're not the dating service for you", it would have been fine! I would have respected that and moved on.

But when they actively lied to me by leading me through the entire onboarding process - when they knew from the beginning that they would reject me - that was beyond the pale.

The "separated" issue makes sense because on Planet Dating "separated" can mean anything from "The divorce papers have arrived and I haven't updated my status yet" to "I'm still living in the same house as my spouse and we have sex in between rows, but I'm not sure where this is going" to "I didn't mention I was married? Oh. Well. Sorry."

But I suspect incompetence rather than malice. They simply didn't care enough - or weren't self-aware enough - to do a basic sanity check on status before onboarding. Or perhaps decided to add the check later and didn't have the spare braincells required to rearrange the onboarding sequence.

You are right, and I ran into a few of those variations including "we still live together and sleep together, but we don't feel any emotional connection any more."

And point well taken about suspecting incompetence rather than malice. Or not even incompetence. I can easily imagine some poor overworked web developer (maybe someone like me!) trying to meet their deadlines and business requirements and not even realizing that the "funnel" should have had a filter at the very top instead of waiting until the end to note the error.

This is why I try to put myself in the shoes of whoever is using my app and hopefully look at it from their perspective. I try not to just to ask myself if the interaction I'm building meets the technical requirements, but how will the person feel who is using my app?

It may have been incompetence instead of malice (eg they only implemented the marital status filter a while after designing the onboarding form). Either way that sounds really annoying, though.

It sounds like they did ask that question first, but only validated it after all the following questions were asked.

> But when they actively lied to me by leading me through the entire onboarding process - when they knew from the beginning that they would reject me - that was beyond the pale.

It doesn't sound like an "active lie," but more like a badly designed on-boarding form (a.k.a. a potentially innocent mistake). They should have presented the dealbreaker questions first, but they didn't.

I met someone out of area on EH in 2012, and we communicated for a couple of years.

We both quit EH. Many months later, I found them still using her (quite attractive) photo in their advertising.

I do the same thing with a gmail address -- just do myemail+uniqueid@gmail.com, because gmail drops everything after the + for routing the email but still tells you which address it was sent to.

I used to do this, but I kept forgetting the "uniqueid" for the sites I used. I'd often resort to using my regular email for the forget password prompts and then would have to search my inbox to figure out the correct email (if using from another device where the creds aren't saved).

Today that problem is solved by the use of a password manager.

What's frustrating is that very many sites know of this method and simply trim the "+uniqueid" from a gmail.com address before inserting it into their database.

That's a bummer. FWIW there are a fair number of non-gmail domains that are gmail-backed (e.g. a lot of universities' email systems) so it should still work with those consistently I hope.

It don't need to be gmail-backed for + to work. I use it on my own domain without any problems and there is no gmail involved

On my domain I made _ and . Also work the same as +, for annoying sites that somehow think + is an invalid character for email addresses.

>What's frustrating is that very many sites know of this method and simply trim the "+uniqueid" from a gmail.com address before inserting it into their database.

Unfortunately, there is a mathematical theorem (greater idiot theorem) that makes it technically impossible to generate a new random string that becomes an inbox that goes to your inbox.

How do I know that it's technically impossible?

Because otherwise Gmail would have done it already, since this takes 20 minutes and fixes a glaring security issue that gives spammers access to your email that you didn't grant.

I can't have an IQ 50 points higher than all Gmail engineers, so it must stand to reason that I'm the greater idiot. Hence there must be something preventing this obvious solution. QED.

Wait, isn’t this exactly what Apple is doing with Sign in with Apple?

yes. But that doesn't mean it's possible, or Gmail would be doing it too. they have PhD's and stuff. (or used to).

so for sure it isn't possible for some reason, even if someone else is doing it.

what other explanation can there be? why would they just have a glaring security hole like that, allowing anyone you try to give a trackable email to with + to just remove it with a regex? It doesn't make sense. there must be some reason it can't work.

Because there is a top tier spam filter that is powered by the ai, and cloud computers? qed qft

Outlook and Apple already offer this service, it’s not impossible.

The + need not have been intended as a spam filter; I use it for bona fide filtering of separate clients’ projects.

Pay for your email address to solve the problem. On my email provider, I can create a catchall alias: *@example.com will end up in my johndoe@example.com mailbox.

So, instead of doing johndoe+hn@example.com, I can do hn@example.com.

If your email provider does not offer a catchall alias option, this is also achievable with an email forwarder (e.g. mailgun), provided you are ok with giving another service provider access to the content of your received mails.

If only it were possible to encrypt emails, oh well

Technically most email is not encrypted so every single mail server in the middle also has access.

> So, instead of doing johndoe+hn@example.com, I can do hn@example.com.

Fastmail has an interesting variation of this that supports multiple users on the same domain: hn@johndoe.example.com. My wife and I both use that feature heavily on our domain.

I used to do this, but it is troublesome some times because some websites use libraries that strip or replace the plus sign and the final email ends up being an address that you don’t have access to.

Most of the time this is not a problem because you can create the account again with the correct email, but I have lost a few good usernames in some popular websites because I pulled this trick on them, Gravatar is one of these websites and the simplest one to explain.

I wanted a specific username that was available; I signed up with an email that looks like username+gravatar@gmail.com and the operation went through, then when I tried to log in, the website kept saying that the email was incorrect. I tried to reset the account using the username instead, which would force them to send a reset link to the email associated to this account, but the emails never arrive. I gave up that and other good usernames in many websites because of the inappropriate handling of email addresses by some popular web libraries.

Also, the same way you learnt this “trick” other programmers discovered it too and implemented a stripping algorithm to remove the unique ID during the registration process, so it is not very useful nowadays unless the website is very obscure and their developers either are rookies or do not have time to prevent this.

> are rookies or do not have time

Reputable websites don't have an incentive to strip out the ID. It is only websites like "sold out" dating websites or otherwise nefarious websites that have that incentive in the first place. So, name+id@domain.com is still useful for filtering and indexing, and in fact if a website does strip out the ID you should ask yourself why would they need to do that.

Any many just fail, assuming '+' is an invalid character

I was once at the receiving end of business talk clearly addressed to someone else on my gmail account.

At first I believed it was some scam but it soon got clear that my account was accidentally siphoning mail from someone using this supposedly clever scheme...

Unfortunately, being part of the standard, it's become fairly common to strip this from email addresses.

It's more effective to have an entire domain at your disposal and just invent $vendor-specific-thing@mydomain.com whenever an email address is needed. On the server end all you need is a catchall to handle it, and you can blackhole whatever addresses become spam magnets (while also knowing which vendor's responsible).

It is not part of any standard. + is a valid email address character and is not special in any way.

It's specified in RFC5233 [0], by "standard" I meant codified in RFC form, like everything else we treat as open internet "standards".

[0] https://tools.ietf.org/html/rfc5233

RFC 5223 uses + as an example. It doesn't even specify whether the detail part comes before or after the user part.

> On email systems that allow for 'subaddressing' or 'detailed addressing' (e.g., "ken+sieve@example.org"),

This rfc merely acknowledges that some systems do this. It doesn't say the must or even should.

This used to work a decade ago when spammers were clueless.

This is ok but many sites strip the plus now (usually the most nefarious ones). Plus you’re linking your identity back to your gmail account which is probably not what you want to do on a dating site or in general online.

I wrote about this here: https://idbloc.co/blog/background/2019/04/14/keep-your-addre... and it’s one of the main reasons https://idbloc.co exists

They may not have sold it — they may have just had their database hacked.

I used to use unique email address per site too, and at least one was clearly hacked rather than sold.

How do you know?

I worked at a company who's bulk mailer company got hacked and all our customer's emails spammed. For a while we could refer irate customers with tagged email addresses to the mailer companies blog post about the breach (although they cleverly never admitted it, just wrote they were investigating it) until a few months later the blog was upgraded to a new system conveniently wiping out the blog post.

> Basically, the market is ripe for a respectful dating site.

I contend that no such thing can possibly exist. The reality of online dating is that it is garbage, and generally the only way to sell people garbage is to lie to them and convince them it isn't garbage. Dating is a gigantic pain in the real world for a lot of reasons that just can't be fixed by a fucking website.

This is why I really miss Craigslist personals, where I could put my writing skills and humor to use.

>Basically, the market is ripe for a respectful dating site. But OKCupid started this way; and in the end they sold out. What makes you think you won't sell out when the money is right?

Seems like it's a problem that can't really be solved by a profit seeking company, and has to be left to a non-profit foundation or something like that.

Image hosting has a similar problem. Imgur used to be the "good" image hoster, but they have been slipping immensly. In the case of something like image hosting I could see publicly funded infrastructure solving the problem. Not sure how comfortable I'd be with this in the case of dating.

How does a respectful dating site make money if they don't charge consumers?

You can charge your customers without indulging in shady practices. You just can't make obscene amount of money doing so.

I remember when PoF was run out of some guy's basement. He was the only one (well, aside from a part-time systems support guy) running it, and he was banking $1M/month (he posted a photo of his check once) from ads.

what does respectful mean to you?

Respect the users. Respect the process. Don't sell out your users for a few $$.

I don’t know much about this space, but is that not true of some of the other apps (Hinge, Bumble, etc)?

Reply on news.ycombinator.com