Hacker News Reader

Comment by legitster | Hacker News Reader

An easier way to spin up emails for every account:

For some email providers, if you add a "+" modifier to your email address, anything after the + will be ignored and still routed to your main email address. But email systems will still treat them as unique email addresses. (So abc123+Netflix@gmail.com and abc123+nytimes@gmail.com would both be delivered to abc123@gmail.com.

This limits their ability to link your accounts against each other. And you can see if someone shares your data when you start getting hits on your Netflix email address.

View on HN

I tried this. Tried this with my domain as well. Spammers have figured this out. They start spamming random emails on my domain and since there's catch all I do receive them. Randomly generated emails from dedicated services (duck.com, HME etc) work better. I can just disable them and don't have to worry about other random emails. Handling all this on my own domain is going to cost me a lot in both money and time and that'd be a lot of headache as well. Also, almost every body worth their spice and sugar knows of that "+ thingie" on gmail.com. Just saying.

Outsource it to a firm dedicated just to mail, like MXRoute.

That's a feature not a bug. Now your in-email client spam filter has a much easier time tagging spam because the same exact spam message sent to three different addresses. It works great for me. I love catch-all.

Are we talking about data being shared across services or spammers? Spammers play by different rules because they can just generate infinite email addresses on the fly and not have to worry about storing them unless they get a hit. I would consider that a different vector than your legitimate email address being shared.

In my experience, a private email domain is a neon sign for spammers. I would never recommend a private domain for privacy or anti-spam reasons.

Maybe that was targeted, I don't get random address spam on my 15yr+ catchall.

I do get a lot of spam sent to [someone else's email] where my own email address was BCC'd.

> This limits their ability to link your accounts against each other

This sounds extremely naive to me. Why would it limit their ability when this feature of gmail has been publicly known forever? All they need to do is ignore everything after the plus when cross-referencing accounts.

I maintain email systems for a living and it's a completely legitimate hack.

Capital 'S' spammers don't care because they hit wide swaths of email addresses by generating random strings. They don't waste money buying data.

On the other hand, when someone is buying your data from Equifax, there might be some real bright actors out there, but the majority of firms engaging in this kind of behavior are not as technologically robust as you would think. So you will still catch people sharing your email address regularly.

Besides, if you have + modifiers in your email, they don't know what sort of shenanigans you might actually be doing with it. For all they know, it's a DLL with a re-router or it junks all non-modified emails.

It seems like some backend code could easily strip the “+” and everything after it before saving an email to a database. Not sure how viable this is but I’ve also never tried it.

They could, but I'd be surprised if they do.

Firstly, we can see that they're using the email exactly as provided (for sending, at least), else filters on the mail we receive wouldn't work.

Secondly, the + trick works because it's valid in email addresses under RFC 5321 and RFC 5322 - the fact that Gmail (and others?) direct all addresses of the format 'foo+bar@gmail.com' to the mailbox of 'foo@gmail.com' is a quirk, not a given. Anyone wanting to trim '+bar' would have to know it's safe to do so for particular providers, and I doubt anyone wants to maintain that list and do extra backend work just in case they want to share on the sly.

I don't think spammers care if trimming the plus-alias doesn't work for some email providers.

Gmail is also pretty popular, so it's not much work to just hardcode it there.

That's the trick - not all email providers behave this way, so systems would have to throw out legitimate emails.

Also, most of the automated email systems are not as sophisticated as people think. Ours actually relies on + wildcards for internal testing.

How many legitimate emails have a + in them and don't use such an alias system? I'm sure they exist, but are probably even less frequent than the amount of people using this alias system, thus it's more profitable to strip it out.

What do you mean by "profitable"?

If you are just trying to datamine for random email addresses, you can do that with a random string generator. If you want a list of Netflix customers accounts, you probably want the same exact email they signed up with.

Besides, you can always make a Gmail rule to junk any emails coming in without a modifier.

Profitable, whether for the company itself or for some oxygen waster to get some metric ("engagement"?) that justifies their salary/promotion.

I'm not saying they will strip out the + from the primary email address used for login/etc - that would be dangerous for many reasons and could deny access to users.

But they are absolutely likely to strip it out for obnoxious behavior which is only valuable at scale and individual failures don't matter - such as ad targeting, email spam, etc. In this case, it doesn't matter if you fail to spam the 0.001% of users with + as part of their actual username if it means you manage to spam the 2% that use + as an alias separator.

My career is to build and maintain marketing email systems. So just from my professional advice, it's still a legitimate hack.

I'm not saying there is not someone out there trying these shenanigans, but in 95%+ of situations you are still going to catch people sharing your data with a + modifier.

I've been using the foo+bar@mydomain trick for over 20 years. I have given this form of email address to well over 1,000 companies and I get exceptionally little spam to foo@mydomain.

Reply on news.ycombinator.com