33 ms·
The number of websites that try reject my email address with a + in it, ugh! Surprisingly, the validation is often done 100% client-side anyway, and simply mod
by Benjamin_Dobell 10y ago
The number of websites that try reject my email address with a + in it, ugh!
Surprisingly, the validation is often done 100% client-side anyway, and simply modifying the incorrect regex lets my email address through... If I wrecked havoc on your back-end, then it's your fault for sucking ;)
- cperciva 10y agoWorse than that: I've encountered a few web sites which accept email addresses with '+' characters... and then tell me that my email address has a ' ' character in it. Every time I see this I think "there's got to be a multiple-form-decoding vulnerability here"...
- mook 10y agoI've got an account where they just plain stripped the + character. Since I happen to have used only alphanumeric charters after, I am now registered with an email address I can't actually receive mail on - it goes to somebody else's inbox. Account synchronization was involved - IIRC the initial address confirmation message got thorough.
- oddlyaromatic 10y agoI thought that though the + is valid, nothing after the + is used to differentiate the email address? I use local+Organization when I sign up for an email list so that I can easily filter, plus I can see if that email address gets shared around. So on places that reject the + I just use everything before it as the local part. Maybe I'm missing something. Edit: I guess not all email providers do it this way but here's a link to more info: https://www.cs.rutgers.edu/~watrous/plus-signs-in-email-addresses.html https://www.cs.rutgers.edu/~watrous/plus-signs-in-email-addr...
- gpvos 10y agoYeah, of course it will work, but then it's harder to filter their mail to an appropriate folder.
- zAy0LfpBZLC8mAC 10y agoAs far as email is concerned, "+" is just a character as any other. You might as well configure your mail server to ignore everything from the first "g" in the localpart when figuring out which mailbox to deliver to. Some mailservers happen to do this with a "+", if it happens to occur in a localpart, but that is just what they happen to be doing. There is nothing technically wrong with an email address like "++foo@example.net" or "x+y+z@example.net" or "+-@example.net", and "a+b@example.net" is a different address than "a+c@example.net", unless the operator of example.net explicitly specifies otherwise.
- Bartweiss 10y agoSo this is true on the email provider side, sometimes. Gmail (and a lot of others) rout foo+bar@gmail to foo@gmail. It's not required, but it's common. The problem here, though, is that the email sender just stripped the + and sent the content to foobar@gmail.com. That's just a totally different account, chosen without warning.
- oladon 10y agoSouthwest (Airlines) does this... or did a few years ago.
- klmr 10y agoHad this problem with Virgin Atlantic. Booked a ticket, never got it.
- gpvos 10y ago...and they probably send the confirmation mail to two addresses, both wrong.
- ryandrake 10y agoEven worse is rejecting my password because it has a + in it! Why do you as a business care what my random password generator spit out?? Scarier still is when it's a server-side response that rejects my password for its contents...
- rickycook 10y agoscarier still is when they let you set it but fail to let you log in (generally happens more with length). i don't know what you're doing, but i know it's not right and it scares the hell out of me
- mariusc23 10y agoI've had that happen with Comcast. I think they fixed it but it was pretty annoying. The signup password input had no max length but the login form did.
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- AgentME 10y agoI had that happen because of length at an online service we needed to use in high school. I believe my password had 9 characters. After requesting a password reset and experimenting I found that the registration form would allow you to enter a password of any length, but the login form would only accept up to 8 characters. What really shocked me was that I was the only one of my classmates that used a password longer than 8 characters.
- vidarh 10y agoSome places have been known to just truncate the password...
- 10y ago
- blechschmidt 10y agoYes, the + is incredibly useful for tagging emails. When I register new web accounts, I always specify a new unique tag so that I can track down the source in case I receive spam. Furthermore, they help my mail server when filtering out junk mail.
- ceejayoz 10y agoA lot of spammers will rip out the + tagging on a Gmail account. Probably works better if you have a domain in front of it via Google Apps.
- blechschmidt 10y agoI do not use Gmail but a self-hosted Postfix instance. I have configured an alias for tagged use only and configured Postfix to reject all emails to this alias without a tag. This means that currently any tag will be delivered but luckily, I am not receiving any spam to this address at all. Originally, I wanted to create a Postfix filter based on an HMAC together with a browser extension which would simply let me generate new valid email addresses in the form of prefix.HMAC(secret, prefix)@example.com but I have never implemented it.
- voidz 10y agoThese days I do this differently; I created a subdomain that forwards all email to my main account. hackernews@foo.example.com would forward to main@example.com, and I can just filter the prefixes. That way I can use the subdomain for my own unique addresses, without interfering or using up addresses on the parent domain.
- blechschmidt 10y agoThis is probably a better approach if your domain provider supports wildcard DNS records. My old provider did not and I am very glad I switched.
- voidz 10y ago
- parennoob 10y agoCan you name some popular websites that do this? Speaking as someone who uses + addresses to filter stuff from mostly well-known websites, I have never seen this. I have seen this a few times on old, crusty, finance websites etc. but I hardly ever need to use a + address with them anyway. (It does make me wonder about how good their internal security is, though.)
- mayneack 10y agoBestBuy allowed me to sign up with a trailing "+bestbuy@gmail.com", but their unsubscribe interface rejects it as invalid, so I can't unsubscribe from their promos. I just filter/mark as spam and move on.
- Benjamin_Dobell 10y agoI've seen this several times as well. If it's a referral link to unsubscribe and is meant to include your email, double check it's okay. If your plus is missing insert "%2B" where it should be. It's less common, but some websites ask you to type your email address once they realise they can't find you on record. If the "+" doesn't work in that field (server side rejected), then you can try %2B there as well.
- Benjamin_Dobell 10y agoYou probably hang around tech sites that mostly have it together. I find common culprits are service companies; gas, electricity, real estate websites, insurance companies etc. EDIT: Oh, and warranties! Man warranty websites tend to suck. Samsung for instance won't let you register your product to an email with a +.
- BuildTheRobots 10y agowhen registering my S3 years ago I realised that samsung wouldn't let you have the word "samsung" or "s3" as part of your email address.
- Roedou 10y ago
- freestockoption 10y agoI had trouble signing up for JetBlue because I had a . in my email address!!!
- dougdonohoe 10y agoI still see sites rejecting ".info" domains. Here's looking at you, Salesforce guest registration in SF and dozens of other sites.
- tempestn 10y agoI recently registered [mylastname].email, thinking to switch over to firstname@lastname.email from my gmail address. Turns out a large percentage of forms don't accept new TLDs.
- deleted 10y ago[deleted]
- toomanybeersies 10y agoIt's because a lot of regex validations (including earlier versions of Angular) have a regex that ends in something like \.[A-Za-z]{2,4}$ (this is the end of the regex in Angular 1.15, it also doesn't support brackets or quotes in the local part, poor showing from Google) At the time when they were written, gTLDs didn't exist, so the longest a tld could be was 4 characters (.info, .mobi). It's pretty piss poor futureproofing to be honest.
- vidarh 10y agoAngular didn't even exist when the first expansion happened, so either they were flat out ignorant, or they copied an earlier regex without verifying it (.museum was part of the initial batch of new gTLDs in 2001)
- vidarh 10y agoI co-founded the company that set up the ".name" TLD as part of the first batch of new TLDs back in 2001, and we had no ends of problems because of that. A lot of people either had hardcoded lists, or they checked the length and refused TLDs longer than 3 characters. We kept e-mailing people about it, and kept getting messages back from people who had "fixed" it by adding just us (we'd generally have pointed people to articles listing other new TLDs too, to make it clear to them that this wasn't just one TLD), or increasing the limit to 4 characters... We quickly gave up on trying to get these people to stop having useless checks and settled for just getting them to accept ours. It's quite shocking people still haven't learnt even after the number of expansions since.
- 10y ago
- Tomte 10y agoI agree that it's annoying. But I have an acquaintance who is constantly bickering and venting about this issue. If he strongly suspects that a signup form will reject his plus address, he will enter it even more fervently to prove they are idiots. I'm firmly on the side of "Too bad. Maybe you could simply move on with your life? Just use a dash if you need sub-mailboxes"
- mulmen 10y agoIs a dash the same as a "+"? According to some quick googling it depends on your provider. If his provider relies on the "+" for sub-addressing what good will a dash do him? Why are you so firm on this position when it seems to be a legitimate problem for him?
- Tomte 10y agoYes, it depends on the mail provider. What is easier and better for your nerves? Moving to another mail provider or getting worked up for years? Or if moving is not an option: how about stop wasting time and nerves on it? Just accept that your mail address doesn't work everywhere. There is no possible uture where you will force everyone on earth to stop mis-validating email addresses! And I've never disputed that the problem is legitimate. I actually said in my comment!
- Sami_Lehtinen 10y agoI've got # in my address and some systems fail with it too. It's totally valid. As example outlook.com won't allow sending email to addresses with # . Also some services reject short addresses for no reason. As example m@em.mm or so, that could be totally valid. You don't know it before checking for MX info and asking from the SMTP server if the address is valid in rcpt to: .
- dugluak 10y agoI think best user experience in this case is to just prompt the user asking whether they have typed in correct email address, if they say yes just go ahead and submit the form.
- Senji 10y agoI just silently accept your + and throw the insignificant bit away.