Hacker News Reader

Comment by jeroenhd | Hacker News Reader

You'll be surprised how many people think they can just use first.lastname@gmail.com and have email magically appear in their account. And even more people have no idea what the @gmail.com/@ibm.com is about. All they know is that some of their emails don't reach their contacts, probably because "the computer broke again".

It's not a hard concept, but it's a concept that was only ever explained in school to a sliver of the population actually using email every day.

Plus, federation makes validating accounts real hard. Looking for a semi-popular Twitter user on Mastodon will bring forth 800 Twitter-to-Mastodon-bridges with plausible-looking domains, only for the real user to end up using something like "hachyderm" as their domain name. I don't know any good solutions to this problem, but that doesn't make the problem go away.

View on HN

I have my own domain, and have email set up so that any email to that domain goes to me.

You'd be surprised (well, nobody here on HN would be) to know how many times I tell a business that my email is "their-business@my-domain.com", and they ask me how I got that email address, whether I work for their company, etc.

Yep. I've had that conversation more than once. They get very suspicious! And probably triggers internal meetings with cyber.

I genuinely wonder how many emails I've missed because some system flagged the email address as invalid or suspicious.

I can only dream that it triggers meetings with security.

I once started receiving spam addressed to <mybankname>@<mydomain>.org and after several instances I reported it to MyBankName.

I explained that I only used that address in my dealings with them and so it must have leaked from them.

They said that's not how email works, you have one address that you use with all your contacts. One of them must have leaked it.

I tried to explain that I used a different host portion with each company I contacted.

They said that's not how email works, you have one address that you use with all your contacts. One of them must have leaked it.

I transferred my balance out and let the account lapse.

why didn't you close the account instead, after transferring your balance, to send them a stronger message?

Sounds like the sort of bank that only allow closure to be requested via fax certain months.

The mailbox is publicly accessible, in the 2nd level basement behind a locked door guarded by a hungry tiger!

Then I request, in no uncertain terms, that the government kindly close those sorts of faxers.

Yeah, I do this with a catchall domain as well. Indeed, I've had people ask if I work for their company -- too funny! So far the only company that has illegally added me to a mailing list I didn't sign up for is H&M (the clothing store).

I hate this stuff. Someone tried to sign up to a crypto exchange with my phone number. :| 3 times they had the code resent!

Even giving them "email+their-business@gmail.com" (instead of email@gmail.com), as every single Gmail user is able to do, will no doubt sow confusion.

I always allocate an email of my+company@myemail.com and the number of email validators that don't accept that "+" is a legit email character is infuriating.

That's why I've updated my SMTP config to handle - the same way as + 10+ years ago. And to avoid "why is my business name in your email?" questions, I rot13 it.

>rot13

That's clever. But doesn't it cause friction when trying to relay the address e.g. over the phone?

Yeah, did the same for my SMTP config way back. Don't think my family users have managed to get their head around it yet though.

> to avoid "why is my business name in your email?" questions, I rot13 it.

That's a neat idea.

Your first sentence took me a second to mentally parse and understand, so to help anyone with that same issue later, what was meant is:

> That's why I've updated my SMTP config to handle the hyphen character the same way as the plus sign over 10 years ago.

This is simultaneously a brilliant idea and hilarious because I can imagine how this must confuse them.

I do the same, and some companies flat-out refuse to accept email adresses with their own name in them. Samsung, notably, won't allow samsung@domain.tld for some obscure reason.

Every time I have to hand out my email over the phone, I brace for having to explain my catch-all to people. Depending on how tired/tech-illiterate the person on the other end sounds, I've started using plausible-sounding alternatives (contact@/hello@/email@) instead.

> won't allow samsung@domain.tld for some obscure reason.

It's not obscure. Some code monkey at Samsung was told to filter out certain addresses, Samsung ones among them, and just used a regex or substring search on the entire address.

It could also fall foul of a Scunthorpe filter - refusing to accept names with some subset of characters, and the company name got added to the filter to avoid "samsungsuxbawls@gmail.com" or similar

Since this happens often, you could try changing the form of the email addresses to make them less confusing. I can think of several options:

1. Prepend "from-", so that instead of <their-business>@example.com you give them from-<their-business>@example.com. It should at least make it easier to explain your approach when you have to.

2. ROT13 or reverse the name of the business so it's gurve-ohfvarff@example.com or ssenisub-rieht@example.com. You can design a different stateless function that maps names to email addresses. The function doesn't even have to be invertible. This is similar to a stateless password manager like https://www.lesspass.com/.

3. Use a list of pre-generated addresses you keep on your person. Think recovery codes. Of course, you can keep the list on a smartphone.

> It's not a hard concept, but it's a concept that was only ever explained in school to a sliver of the population actually using email every day.

It's not hard to someone with exposure to a certain medium. Though its a bit dismissive like it would be for a mechanic to question why a person doesn't know know about rotors, spark plugs and other "simple" car concepts.

> You'll be surprised how many people think they can just use first.lastname@gmail.com and have email magically appear in their account.

Since I like surprises, do tell ... how many people think that?

You are probably being cheeky, but just in case:

https://en.m.wikipedia.org/wiki/Idiom

https://hinative.com/questions/18367967

At least 6 with my not-that-common (maybe somewhere in the middle) first and last name combination.

Maybe more, but at least six of the emails meant for others that I've received, implied they live at those six unique locations.

I know one of them likes to get the vegetarian meal option when traveling internationally by plane.

(Companies should really validate email address OWNERSHIP before spamming innocent people.)

Are you sure they were confused people? More probable explanation is that they made typos while entering their email.

The alternative explanation, that they roitinely use [your name].[your last name]@gmail.com as their email, and don't realize that it never works is... unlikely IMO.

My wife has been receiving medical appointments, test results, event tickets, package tracking numbers and so on destined to a few old ladies for years. I once tracked the sons and nephews of one and told them, and they apparently thought I was some kind of scammer and didn't return messages after a couple exchanges, so to this day she still receives all those.

One of the emails had a phone number for the intended recipient, so I called. It was an old person who was definitely confused.

I can easily imagine there are a bunch of older people who do not have email addresses, yet just about everything requires an email address, even if it's not necessary for whatever service, so people have to either make up an address, or incorrectly remember what the address was that their children or grandchildren set up for them.

Either way, that doesn't excuse the companies that spam innocent people.

> (Companies should really validate email address OWNERSHIP before spamming innocent people.)

I don't understand why this isn't part of the normal flow for implementing Verify Your Email emails.

Someone used my firstname.lastname Gmail address on trip dot com a couple of days ago to book flights, and their Verify Your Email email actually had a Not My Email-type link in it... which apparently does nothing, as I shouldn't know that if you phone trip dot com about changing your flights, they send you an email with a Change Flight link.

I just got off a chat with their support, so hopefully my fat-fingered doppelganger doesn't miss their flights from Atlanta to Sydney tomorrow.

If the email they were trying to reach was [firstname].[middle initial].[lastname] and they forgot the middle initial that would explain why it's showing up in your inbox.

Now that I think about it, I don't think I've ever seen an email verification flow that works in reverse, where the email owner sends the email instead. Seems it would be easy enough to say "Send an email from your indicated account with <pin> to <corporate email address>." I'm assuming the flow is different enough that it would lead to losing people who decide not to follow through but who would have continued with the 'normal' setup. It would also train users to send their MFA pins to others which would be a net negative for anyone using the normal verification process.

Several years ago, I started getting mass amounts of signups to one of my gmail accounts by the same person (thanks to some of these, I found out her first and last name). Some months after it started, I realized she also had the twitter account with that same name. I don't think she knew gmail and twitter were different things.

> You'll be surprised how many people think they can just use first.lastname@gmail.com and have email magically appear in their account.

I get a pile of junk from people who assume they can do that. I guess I have a lot of stupid distant relatives. It was the same for Hotmail too I got so many hotel receipts, or resume replies etc. one went on for decade or more. Yes you can reply back "no this is wrong" but nobody listens.

> I don't know any good solutions to this problem, but that doesn't make the problem go away.

Abandoning the concept of celebreties and instead using social media for social interactions with people who you can "validate" their identity by walking over to them and asking them for their ID.

Reply on news.ycombinator.com