5 ms·

That isn't an account - Gmail sends anything with a +whatever in it to the address without the plus. So, me+mine@gmail.com goes to me@gmail.com. It's useful fo

by untog 11y ago

That isn't an account - Gmail sends anything with a +whatever in it to the address without the plus. So, me+mine@gmail.com goes to me@gmail.com. It's useful for exactly the filtering you are describing - and I also use it to track which sites sell my address to spammers (though it's such a simple regex replacement that I'm sure some hide doing so)

smoyer 11y ago
It's part of the specification ... Anything after the plus sign is considered a comment.
- sp332 11y ago
  I'm pretty sure that's not true. '+' is allowed in an email address, but it's just a normal character, not a comment. Comments are made with parentheses. https://en.wikipedia.org/wiki/Email_address#Syntax https://en.wikipedia.org/wiki/Email_address#Syntax
  - silix 11y ago
    you need to scroll down in your link. https://en.wikipedia.org/wiki/Email_address#Sub-addressing https://en.wikipedia.org/wiki/Email_address#Sub-addressing
    - sp332 11y ago
      That's a different "spec" which may or may not be implemented by any given email provider.
logicallee 11y ago
it's literally security by obscurity since gmail does not allow a genuine + in emails, so: >I also use it to track which sites sell my address to spammers (though it's such a simple regex replacement that I'm sure some hide doing so) ...is Google dropping the ball by doing something insecure. The secure version is to be able to assign a randomized alias, for example I should be able to request an alias and get a high-entropy string like buffaloaerypyrite which is associated with "me+fromDatingSite", which is this great group I heard for meeting singles who are into knitting, my biggest hobby! Then I can give DatingSite the address "buffaloaerypyrite@gmail.com" and have it go to my inbox and be marked fromDatingSite, just as it does currently. But if escorts start sending me mail to "me+fromDatingSite" I don't have to be able to rely on the security by obscurity that protects me from getting spam that is not marked with that source, if any of them figure out how to remove the + so that they can reach the inbox I read everything in. It's a simple key-value lookup table and would close a security hole that allows spammers to reach you. It is mandatory for Google to let me give out "buffaloaerypyrite" instead of "me+fromDatingSite". Unfortunately, instead they have a non-scalable solution that doesn't work. This is why I'm faced with a choice, and can either use an unsecure version and rely on security by obscurity, or use a real throwaway email. I use a real throwaway email anyone can read (mailinator). Because Google's engineers either don't understand how to secure their solution, or believe that security by obscurity is sufficient. I've never once in my entire life given out my gmail email address with a + in it, even though I know exactly how this method works and how to use it. Never once. I'm not stupid enough to use security by obscurity. But it's great that they have it and are a single key-value lookup from having it work properly. Any day one of them will realize the implications and implement the solution, which can be prototyped in 7 minutes in any technical stack and be fully pushed out within a day or two. It's trivial. I have faith they will realize it sooner or later. You can do it, Google. Be better.
- DigitalJack 11y ago
  I can't tell if this is serious or not.
  - logicallee 11y ago
    Yes, I'm serious. I don't only use mailinator: some sites blacklist mailinator and somehow blacklist its alises (I know devnullmail off the top of my head, to name one of its aliases). For this reason I also have a gmail account dedicated to spam. I just checked for you, and have received 6 pieces of mail to it in the past three day, to the inbox (not filtered as spam). But hey, you go ahead and continue to rely on the fact that spammers will never ever figure out how to apply a s/\+(.+)@gmail.com/@gmail.com/g to a list of email addresses (since I and most people use gmail.com and not some other domain). I don't know how much spam my mailinator accounts get, since I don't check them. But let's check throwaway@mailinator.com since I bet someone has picked that name. In the past hour this is the spam it got: http://imgur.com/PS7O3Ov http://imgur.com/PS7O3Ov That's 9 pieces of spam in 2 hours. You think Dr Dave, who personally addresses someone who signed up somewhere as (throwaway) in his subject line, is above applying a regex? Do you think the person who sent out "1 Sl!tty Friend Alert" is above applying that regex? You think that Kaylyn, who sent out "Two cute ebony teens in threesome" is above applying that regex? That's nice. That's the definition of security by obscurity. Literally the definition. So, yes, I'm serious.
    - untog 11y ago
      But that spam would never appear in your Gmail inbox. Google decided (rightly, IMO) that it would be a better use of time to filter spam than provide email aliases.
      - logicallee 11y ago
        Of course it should appear in my Gmail inbox: I actively give out the email and thereby expect that my recipient can send me mail whatever they want. If I give Bob's Spam Emporium the email address "squirehamboard@gmail.com" which means "me+bobspam@gmail.com" then that means I've given Bob the means to email me whatever they want. You literally give someone permission to email you when you give them an email address, it's pretty much the definition of giving out an email address. If Bob starts going overboard on emailing squirehamboard@gmail.com that doesn't mean I don't still want to see all that crap. Maybe I really care about what Bob has to say. Or maybe he's selling email address to sweepstakes companies, Nigerian princes, investment opportunities, fake legal notices, and so forth. It's nice of Google to try to decide these things and help me classify my mail. But ultimately providing email aliases is an important step. They have all of the comment functionality in place (me+comment@gmail.com goes to me@gmail.com with the label comment) and now just need to be able to give me an alias for "me+comment" so that I can give that out instead of my valuable string "me", which I don't want to give spammers. It's not really rocket science. They're 99.99% of the way there. I hope sooner or later some luminary will take that final 0.01% and let me stop using mailinator for registrations that I expect have a high chance of spamming me in the future. :) I'd like to be able to trust Bob's Spam Emporium first, have it really go to my inbox, and only redirect squirehamboard (i.e. me+bobspam@gmail.com) if I ever read an email that I shouldn't have gotten to it. (Since it'll be labelled bobspam it'll be easy for me to decide if I want to nuke it all or just redirect it.) Gmail's spam filtering is pretty good. Ultimately, part of what makes it good though is that I don't give my gmail address out to spammy sites at all. I bet I'd get a lot more spam if I didn't use mailinator as well...

by untog 11y ago

smoyer 11y ago

It's part of the specification ... Anything after the plus sign is considered a comment.

sp332 11y ago
I'm pretty sure that's not true. '+' is allowed in an email address, but it's just a normal character, not a comment. Comments are made with parentheses. https://en.wikipedia.org/wiki/Email_address#Syntax https://en.wikipedia.org/wiki/Email_address#Syntax
- silix 11y ago
  you need to scroll down in your link. https://en.wikipedia.org/wiki/Email_address#Sub-addressing https://en.wikipedia.org/wiki/Email_address#Sub-addressing
  - sp332 11y ago
    That's a different "spec" which may or may not be implemented by any given email provider.

logicallee 11y ago

it's literally security by obscurity since gmail does not allow a genuine + in emails, so: >I also use it to track which sites sell my address to spammers (though it's such a simple regex replacement that I'm sure some hide doing so) ...is Google dropping the ball by doing something insecure. The secure version is to be able to assign a randomized alias, for example I should be able to request an alias and get a high-entropy string like buffaloaerypyrite which is associated with "me+fromDatingSite", which is this great group I heard for meeting singles who are into knitting, my biggest hobby! Then I can give DatingSite the address "buffaloaerypyrite@gmail.com" and have it go to my inbox and be marked fromDatingSite, just as it does currently. But if escorts start sending me mail to "me+fromDatingSite" I don't have to be able to rely on the security by obscurity that protects me from getting spam that is not marked with that source, if any of them figure out how to remove the + so that they can reach the inbox I read everything in. It's a simple key-value lookup table and would close a security hole that allows spammers to reach you. It is mandatory for Google to let me give out "buffaloaerypyrite" instead of "me+fromDatingSite". Unfortunately, instead they have a non-scalable solution that doesn't work. This is why I'm faced with a choice, and can either use an unsecure version and rely on security by obscurity, or use a real throwaway email. I use a real throwaway email anyone can read (mailinator). Because Google's engineers either don't understand how to secure their solution, or believe that security by obscurity is sufficient. I've never once in my entire life given out my gmail email address with a + in it, even though I know exactly how this method works and how to use it. Never once. I'm not stupid enough to use security by obscurity. But it's great that they have it and are a single key-value lookup from having it work properly. Any day one of them will realize the implications and implement the solution, which can be prototyped in 7 minutes in any technical stack and be fully pushed out within a day or two. It's trivial. I have faith they will realize it sooner or later. You can do it, Google. Be better.

DigitalJack 11y ago
I can't tell if this is serious or not.
- logicallee 11y ago
  Yes, I'm serious. I don't only use mailinator: some sites blacklist mailinator and somehow blacklist its alises (I know devnullmail off the top of my head, to name one of its aliases). For this reason I also have a gmail account dedicated to spam. I just checked for you, and have received 6 pieces of mail to it in the past three day, to the inbox (not filtered as spam). But hey, you go ahead and continue to rely on the fact that spammers will never ever figure out how to apply a s/\+(.+)@gmail.com/@gmail.com/g to a list of email addresses (since I and most people use gmail.com and not some other domain). I don't know how much spam my mailinator accounts get, since I don't check them. But let's check throwaway@mailinator.com since I bet someone has picked that name. In the past hour this is the spam it got: http://imgur.com/PS7O3Ov http://imgur.com/PS7O3Ov That's 9 pieces of spam in 2 hours. You think Dr Dave, who personally addresses someone who signed up somewhere as (throwaway) in his subject line, is above applying a regex? Do you think the person who sent out "1 Sl!tty Friend Alert" is above applying that regex? You think that Kaylyn, who sent out "Two cute ebony teens in threesome" is above applying that regex? That's nice. That's the definition of security by obscurity. Literally the definition. So, yes, I'm serious.
  - untog 11y ago
    But that spam would never appear in your Gmail inbox. Google decided (rightly, IMO) that it would be a better use of time to filter spam than provide email aliases.
    - logicallee 11y ago
      Of course it should appear in my Gmail inbox: I actively give out the email and thereby expect that my recipient can send me mail whatever they want. If I give Bob's Spam Emporium the email address "squirehamboard@gmail.com" which means "me+bobspam@gmail.com" then that means I've given Bob the means to email me whatever they want. You literally give someone permission to email you when you give them an email address, it's pretty much the definition of giving out an email address. If Bob starts going overboard on emailing squirehamboard@gmail.com that doesn't mean I don't still want to see all that crap. Maybe I really care about what Bob has to say. Or maybe he's selling email address to sweepstakes companies, Nigerian princes, investment opportunities, fake legal notices, and so forth. It's nice of Google to try to decide these things and help me classify my mail. But ultimately providing email aliases is an important step. They have all of the comment functionality in place (me+comment@gmail.com goes to me@gmail.com with the label comment) and now just need to be able to give me an alias for "me+comment" so that I can give that out instead of my valuable string "me", which I don't want to give spammers. It's not really rocket science. They're 99.99% of the way there. I hope sooner or later some luminary will take that final 0.01% and let me stop using mailinator for registrations that I expect have a high chance of spamming me in the future. :) I'd like to be able to trust Bob's Spam Emporium first, have it really go to my inbox, and only redirect squirehamboard (i.e. me+bobspam@gmail.com) if I ever read an email that I shouldn't have gotten to it. (Since it'll be labelled bobspam it'll be easy for me to decide if I want to nuke it all or just redirect it.) Gmail's spam filtering is pretty good. Ultimately, part of what makes it good though is that I don't give my gmail address out to spammy sites at all. I bet I'd get a lot more spam if I didn't use mailinator as well...