Gmail trick: multiplying your address | Hacker News Reader

Gmail trick: multiplying your address

blog.hipwerk.com

59 pointspyderman55 comments

Incomplete Article for old well known stuff:

1. "Gmail has a wildcard for the + sign as it doesn't recognize it nor any characters that follow it." This wrong. It is well documented and called aliasing within Google. There is even a support page for it: https://support.google.com/mail/answer/12096?hl=en

2. Even that is documented: https://support.google.com/mail/answer/8158?hl=en

3. Even that is documented: https://support.google.com/mail/answer/159001?hl=en There are also a lot of ccTLDs that Google has for Gmail. Also those will work.

Yes, you're right about the support pages. I only knew about the "+" sign until now and it seems like lots of people didn't knew about this :)

Not everyone knows everything. I knew all of this, but lots of people don't.

If there's one thing I think I could change about HN, it would be that we'd be easier on people who don't know things. Many times I'll read an article about the new version of PolyDoopWerks, and be told that it's the Uber-of-OOD-builders, and have no idea what's going on.

True, but this works for more than 10 years. There are things called basics or common sense. (o;

Having a detailed knowledge about how google handles permutations of email addresses does not fall within the realm of common sense, nor "basics."

The length of time that it has existed is irrelevant--it's simply not commonly used yet. It's advanced usage, not basic.

To be honest, I've abandoned that use for some years now and use simply a catch-all on my domains. Much easier to use, especially as many larger organizations rejecting the + because of "fake" email address.

Yes, because everyone that uses Gmail has been doing so for 10 years. /s

While we value the knowledge you have to share with us, there are words you can choose to convey that knowledge that won't leave you coming off so brashly.

I'm relatively new here. While I do run across comments where people seem to be talking down to others, I see that they are mostly in the minority. That is very refreshing, compared to most other sites where intellectual conversations are taking place.

I usually just chalk it up to the difficulty in conveying emotion through strictly text. In the case where it is obviously not so, it's easy enough to ignore the person.

Basically, there's always going to be one or two of that guy in any conversation. I'm just happy that they're seemingly kept to a minimum on HN.

Seconded. I like reading and learning here. There is a lot I don't know. And that's cool. Most folks are in the same boat. Thanks for the comment.

It isn't always easy when something does seem to be common knoweldge, but you are correct that people try to be more understanding. I have adopted the attitude from this XKCD comic. https://xkcd.com/1053/

Ironically that comic and XKCD in general falls into the category of things that are very widely-known but people still present as new information. (The prime example being cryptography discussions linking to correct horse battery staple.)

Perfection.

+100 for the xkcd.

I've seen some sites reject the + in email address forms. YMMV.

Yeah, that annoys me a lot. Always these people who want to reject "fake" email addresses not knowing that there is a lot of weired stuff allowed according to the RFC. Funny thing, mostly these are the big corporations who rejects them, the ones who also mandate secure passwords but please without a special character, only small letters and numbers, and please not more than 10 characters. Wonder what they now do with all those new gTLDs.

So a support page is what passes for documentation now?

Also called sub-addressing in RFC 5233[0] or Address Tags. Gmail is not the only one of the email providers that enables this. Yahoo, Apple, Outlook, Fastmail and others also support this. More information at Wikipedia: http://en.wikipedia.org/wiki/Email_address#Address_tags

[0] https://tools.ietf.org/html/rfc5233

Nice! Didn't knew that other providers do it aswell.

I highly recommend Sneakemail.com and have been using them for over a decade. They let you set up keywords, like "foo", and then you can mail anything-foo@sneakemail.com (or snkmail.com, since a few sites block the former domain) and it creates an alias. On the Sneakemail web UI you can enable/disable aliases and see recent mail. An alias can forward up to 5 people or so, and when someone sends you mail, if you reply you'll reply through Sneakemail.

Of course it's also worth mentioning Mailinator.com (one-off throwaway aliases, but public) and 10minutemail.com (super-disposable temporary email addresses).

Wow, awesome tips! Will check them out and write a follow-up

I've also been using sneakemail for at least twelve years. They also let you set up addresses with a bunch of randomly generated letters/numbers that are opaquely mapped to you, but you have to log in to do that.

The only problem is that some sites ban their domains - in particular Adafruit does this (they banned existing use of it, not just new sign ups), and their support said basically "we won't whitelist your address even though you've been ordering stuff from us for over five years".

Also try 33mail.com for throwaways. You get a subdomain, so you can do [anything]@foo.33mail.com or [anything]@foo.33m.co

//TODO: Check user_email for multiple variations of the same account by calculating and storing a canonical e-mail field in the DB as well.

yeah, seriously.

Assuming you are trying to prevent people from creating multiple accounts on your service... keep in mind they could create e-mail forwarders at other domains, this just stops a very easy method.

Also, more importantly, this would have to only apply to a set a whitelisted domains, plenty of non-gmail systems would treat these variations as distinct addresses. So without a set of domains to apply this logic too, you could end up stopping users from registering with their own normal/actual address.

For #2. The dots are completely irrelevant, so you can actually add and remove.

    m.axm@gmail.com
    ma.xm@gmail.com
    m.ax.m@gmail.com
    m.a.x.m@gmail.com

etc etc etc

Easier to just get a custom domain and set up a catch-all account to forward to your gmail.

This way you can do [sender]@domain.com, [company]@domain.com, john1, john2, john3@domain.com and never run out of options. If one starts spamming you can just stop a particular [company]@domain from forwarding.

Keep in mind that catch-all accounts usually get a lot of random spam. If you're using this domain to signup for various services, at some point, spammers will become aware of it. And, they'll start sending a lot of spam to (random string that spammer comes up with)@your-domain.com.

I have catch-all running for a few years now, but no real spam problem. Maybe due to the fact that greylisting still works pretty effective. Most of the spam I receive is on my GMX including the email address I never used for sign-ups of any sort.

This is why mail hosts and MX registrars offer spam blocking.

I'm sorry, but I've grown to hate this feature. I keep receiving emails from accounts I didn't sign up for, only to discover the person (with a similar name) used an email address like "senor.developez@gmail.com" or "senordevelopez" and the site itself defaults to "gmail.com". These are not off-the-wall websites, I've had long conversations with Netflix and a satellite TV service. You'd be surprised how many website do not authenticate the email account given.

The simple solution to this is to request a password reset from that service and disable their account.

I have found a few sites reject the + in gmail addresses. I also suspect most DB (or wannabe spammners) would know about this and remove anything after the + sign. Same goes for the "." trick. Still good to know though.

I'm now using Blur (https://www.abine.com/index.html). Very effective so far at creating aliases pointing to my real email. Only worried on how they'll fund their operations long term.

I have an application set up with Devise handling authentication for me and Devise allows me to create multiple accounts with the same email address. Considering how commonly used Devise is for setting up a site with Ruby on Rails, this is a huge open hole for a lot of websites who might not appreciate multiple user accounts tied to the same email.

It kinda bugs me when people describe +foo as a "gmail trick". That type of addressing predates gmail, and exists outside of it still. In fact the plus is not the only form of this. qmail uses the dash, and postfix allows you to configure anything as a separator.

I'm using the '+' for automating email tests - using that and Gmail's API I can set up asynchronous tests against unique email addresses, and test them as they arrive. This is a crucial part of integration testing with partner companies.

This is why email is wonderful. It works so well that people are marveling about learning standard features that were deployed before they were born.

If only we stuck to a few good ideas instead of overwhelming ourselves and each other with bad ideas.

I use the + trick, but several signups don't allow the + sign in e-mail addresses.

I've run into a situation where I was able to sign up using the + in the e-mail, but not login (or unsubscribe from their newletter) with the same address.

They probably recognized the + and stripped it, as well as all subsequent characters, from your address upon form entry.

They should probably strip it from the login form, then.

As a mediocre web dev, that'd be my next step.

Same here, it's quite often, actually. Enough that I won't do it anymore.

Humorous related story -- I was a customer of GM's OnStar service, and had a login on their web portal that I used for account maintenance and to check on vehicle stuff. Sometime later, the GM team rolled out a new version that blocked periods, but my account name had a period. It would happily send me an account recovery email with my now invalid username that I couldn't use. Nor could I configure a new account as it would happily point me to my old, now invalid account. The version without the period did not work.

This was a pretty fringe service of negligible value to me, so when my CC changed I sent them an email telling them of this problem, and my inability to change my account. No response.

So I let the account expire. Still couldn't believe that a team could make a new presentation that blocked already in place usernames, nor would they do anything about it.

What I want is something like a 10-minute-mail inside my gmail account!!!

Yahoo Mail does this. You can make a specific new address and then delete it when you're done. https://help.yahoo.com/kb/mail/SLN3523.html

Fastmail also does this. They have hundreds of domains you can use for disposable accounts.

Yes, that's on my wishlist too!

I just use mailinator. No charge, no hassle, you don't have to set it up first. Half the time I don't even end up checking it. So far I don't really have a use case for plus addressing.

I never understood why people rely on the + trick to determine the source of new spam. Wouldn't a smart spammer / list-seller simply strip the suffix from all @gmail.com addresses?

I've thought the same thing since I encountered this trick a few years back. My guess is that most email providers don't allow the use of a "+" in the address and as a result its viewed as a fringe case and not accounted for.

It's not a valid way to test for illicit spam, but it's a good way to help keep honest people honest.

There are researchers who make brand-new addresses and put them in various places as a tripwire for spam.

According to my experience quite many email address validators on web sites don't consider the address with "+" as valid.

I used to send it at mailing lists and sign-ups.

However, I Noticed spammers have learned the trick and omit the "+..".

I'm running my own email server and use the dash/minus - instead. Works great.

  >  I Noticed spammers have learned the trick and omit the "+..".

If you control your own email,

1. Configure a different character, e.g. ‘-’, as your subaddress separator.

2. Set up ‘joe@example.com’ as a spam trap.

3. Set up ‘joe+from@example.com’ as an email address.

4. Provide ‘joe+from-random-signup@example.com’ externally.

Reply on news.ycombinator.com