5 ms·

> One more interesting tidbit is if you use unique sub-addresses for each of the sites you sign up to you will be able to see when someone, or rather who, sells

by educar 11y ago

> One more interesting tidbit is if you use unique sub-addresses for each of the sites you sign up to you will be able to see when someone, or rather who, sells your email to someone else... Busted! Can't the spammers simply strip the subaddress/label after '+' ?

MatthaeusHarris 11y ago
They can. They don't. It's extra effort for them for nearly zero marginal gain.
- _asummers 11y ago
  Some sites however will just ban + on registration. I've seen registration allow + but login disallow (also different password lengths occasionally, wtf?), though I can't think of any offhand.
- dingaling 11y ago
  > It's extra effort for them for nearly zero marginal gain. I wouldn't say it's nearly-zero gain; by applying a tiny sed expression they obtain a basically unblockable e-mail address. It's easy to blacklist johndoe+amazon@gmail.com but very few people would be willing / able to blacklist their top-level johndoe@gmail.com. So the spam keeps coming. Spammers are annoying but the progammers behind them are smart.
voidz 11y ago
It doesn't have to be +. It can be any character you configure. Recent postfix versions even supports multiple characters.
ortusdux 11y ago
I went a step further and bought a .com that I setup with a catchall email forwarder. Most signups get a custom email at that domain. I still get Russian bride emails sent to oilchangeplace@
51Cards 11y ago
Exactly. This technique while noble in intent is very easy to subvert. I tried subaddresses for over a year and still found spam coming in without the tag. I don't know if others have had more success with it but I haven't noticed a difference. I'm pretty sure it's just being stripped. Perhaps the reverse is more effective. Use a subaddress for all your mail and ignore that without a label coming in.
kps 11y ago
No, they can't. Or rather, they can, but they'll be wrong. The ‘+’ is not a feature of email addresses; it doesn't mean anything different from any other character. It's just a feature of some destination systems that they ignore everything from ‘+’ when assigning incoming mail to accounts. Generally, that's configurable; e.g. in postfix it's set by the optional |recipient_delimiter|. Suppose it's set to ‘-’, and you, John Public, sign up for SuspiciousService using the email address <john+public-suspserv@example.com>. Normally, the mail gets delivered to your 'john+public' mailbox. But if Mr Spammer strips everything from ‘+’, he sends to <john@example.com>. And your system knows that that is not only not a valid local mailbox, but also that it matches a plus-stripped address, and therefore consigns the message and its sender to the fiery pits of hell.

by educar 11y ago

MatthaeusHarris 11y ago

They can. They don't. It's extra effort for them for nearly zero marginal gain.

_asummers 11y ago
Some sites however will just ban + on registration. I've seen registration allow + but login disallow (also different password lengths occasionally, wtf?), though I can't think of any offhand.
dingaling 11y ago
> It's extra effort for them for nearly zero marginal gain. I wouldn't say it's nearly-zero gain; by applying a tiny sed expression they obtain a basically unblockable e-mail address. It's easy to blacklist johndoe+amazon@gmail.com but very few people would be willing / able to blacklist their top-level johndoe@gmail.com. So the spam keeps coming. Spammers are annoying but the progammers behind them are smart.

voidz 11y ago

It doesn't have to be +. It can be any character you configure. Recent postfix versions even supports multiple characters.

ortusdux 11y ago

I went a step further and bought a .com that I setup with a catchall email forwarder. Most signups get a custom email at that domain. I still get Russian bride emails sent to oilchangeplace@

51Cards 11y ago

Exactly. This technique while noble in intent is very easy to subvert. I tried subaddresses for over a year and still found spam coming in without the tag. I don't know if others have had more success with it but I haven't noticed a difference. I'm pretty sure it's just being stripped. Perhaps the reverse is more effective. Use a subaddress for all your mail and ignore that without a label coming in.

kps 11y ago

No, they can't. Or rather, they can, but they'll be wrong. The ‘+’ is not a feature of email addresses; it doesn't mean anything different from any other character. It's just a feature of some destination systems that they ignore everything from ‘+’ when assigning incoming mail to accounts. Generally, that's configurable; e.g. in postfix it's set by the optional |recipient_delimiter|. Suppose it's set to ‘-’, and you, John Public, sign up for SuspiciousService using the email address <john+public-suspserv@example.com>. Normally, the mail gets delivered to your 'john+public' mailbox. But if Mr Spammer strips everything from ‘+’, he sends to <john@example.com>. And your system knows that that is not only not a valid local mailbox, but also that it matches a plus-stripped address, and therefore consigns the message and its sender to the fiery pits of hell.