12 ms·
> So if you’re enforcing unique email addresses, or using email addresses as a user identifier, you need to be aware of this and you probably need to strip all
by flurdy 9y ago
> So if you’re enforcing unique email addresses, or using email addresses as a user identifier, you need to be aware of this and you probably need to strip all dot characters from the local-part, along with + and any text after it, before doing your uniqueness check. Currently django-registration doesn’t do this, but I have plans to add it in the 3.x series.
Sorry what? That seems pretty unneccessary. A third party system to dictate how a third party system handles it local alias system for emails? I can't see any benefit to that.
Whether a mail server handles '+' in a standard way is not guaranteed, and surely it is up to the user how they use that feature if enabled.
- dharmab 9y agoIf you don't do this your system may allow users to sign up for multiple accounts and double-dip on signup benefits, free trials and other "one per account" features. (Barring additional controls, of course).
- eli 9y agoWell, that's always a risk. The thing this guards against is someone accidentally creating two accounts with variations on the same address and being very confused.
- chii 9y agoi recall Amazon did something quite amazing, which is to suggest to the user who signed up twice whether an existing account is the same. but only after they've purchased!
- aeruder 9y agoOr they could just sign up at one of the numerous free email providers with a different username. Stripping the + suffixes is only providing one thing - pain for the users that want to use it.
- slhck 9y agoThe author suggests stripping the part before doing the uniqueness check. This does not mean that the username (email address in this case) would not be allowed.
- bdhess 9y agoIt would for the second user whose address resolves to the same result from the “uniqueness” check.
- coredog64 9y agoI wish this would happen. There's a "rocket surgeon" on the East Coast who has (tried) to sign up for Facebook, Twitter, Steam, and a bunch of sleazy 'message gurlz now' apps using my Gmail address without the period. Obviously it never works, as I get the "I see you're trying to create a new account" email, but one of these days he's going to figure out a way to take over one of those accounts and then I'll really be fked.
- reaperducer 9y agoI have a similar problem with someone who keeps (hopefully accidentally) putting my landline number into Facebook, then I get a call with a recording asking me to press some number to verify my Facebook account.
- bdhess 9y agoI don’t understand your complaint. Google resolves the addresses john.smith@gmail.com and johnsmith@gmail.com to the same account, which you control. (1.) What are you imagining is the attack vector exactly? (2.) Are you asserting that all website owners should build to Google’s (non-standard) behavior?
- joshmanders 9y agoI'm curious as to who would use a service someone else is using, sharing their email but with a local addition? Can me and my wife both sign up to HN and use my email but hers be josh+swife@joshmanders.com and mine be josh@joshmanders.com? That's a strange usecase, isn't it?
- tjoff 9y agoIf you as a service provider can't accept that you shouldn't be offering those free trials / benefits at all. This isn't an issue.
- etxm 9y agoYou’re gonna be sad to know that mailinator[1] and it’s 100s of domain aliases exist. You’re fighting the wrong battle. [1] https://www.mailinator.com/ https://www.mailinator.com/
- jcomis 9y agoSome places check for these types of services though
- zingmars 9y agoThey do, but they're not very effective. They might have an up-to-date list of domains belonging to the big services (i.e. Mailinator), but you can always just google "Disposable e-mail", open the 10th page and pick the first one, and it's pretty much always guaranteed to work.
- jstarfish 9y agoI beg to differ. I use this blacklist and not much gets by. Anything that does, I blacklist manually. https://github.com/martenson/disposable-email-domains/blob/master/disposable_email_blacklist.conf https://github.com/martenson/disposable-email-domains/blob/m... A lot of sites I've come across lately are going back to the old-school way of only whitelisting email addresses from .edu domains or ISP accounts ("@comcast.net").
- antihero 9y agoThat's an absolutely ridiculous idea and a good way to destroy the amount of users you're getting. Do you whitelist Gmail? Then it's piss simple to sign up to multiple accounts. Do you not? Good luck a massive portion of the internet to sign up...
- jstarfish 9y agoI don't want the sort of users who are signing up to perform financial transactions using services like mailinator and guerrillamail. It's always fraudulent. Gmail itself is allowed, but the addresses are normalized. I'm well aware of its potential for abuse.
- sosilkj 9y agoAgreed. From RFC 2822: "The local-part portion is a domain dependent string." Headaches await you if your code is making a lot of assumptions about how the originating domain manages that local-part portion.
- oakesm9 9y agoApple ID's make assumptions (they strip out the + and everything after it) and it's made it a nightmare to use iTunes Connect. Their multiple account support is still terrible so it's easiest to have an Apple ID per iTunes Connect account. Now I need to setup actual aliases in my GSuite account...
- fingerlocks 9y agoWait, what? I exploit the crap out of the + emails, specifically for iTunes connect. I have multiple apple ids under one email address, and I don’t recall any issues
- lentil_soup 9y agoAbsolutely this. It's not even a standards issue, for the outside world they're completely different email addresses. The fact that they happen to land on the same inbox for some providers is unrelated, it's just how that particular provider decided to handle all your different email accounts.
- dalore 9y agoYes! And if you have your own domain, you can just setup a *@example.com to be your one email address. And then you can give a different email address out anyway even without needing to go +. As you said each system can treat it differently.
- detaro 9y agoAgreed. The + thing probably is "only" unfriendly to powerusers, but stripping dots can easily get in the way. Several of my e-mail addresses have "duplicates" that just differ in a dot and are owned by entirely different people.
- Glyptodon 9y agoI was with him most of the way, but the advice about emails seems very user hostile to me.
- yxhuvud 9y agoStripping out things past the + will also break things for users that intentionally are creating more than one signup. This seems like a really bad idea.
- LambdaComplex 9y agoThat's the entire point, no?
- hueving 9y agoWhy do you want to detect the difference between a user signing up with one email account twice or two different accounts? It's folly to try to detect this in this manner and you will only piss off regular users.
- chii 9y agoThe service that's trying to strip the +'s are trying to prevent users from using their (usually free) service in a way that will cost them more money, but never convert to and profit. i understand why they do it, but i can't condone it off course. The service should just allow it, and make sure the appropriated subscribing fee.
- rootkea 9y ago> The service that's trying to strip the +'s are trying to prevent users from using their (usually free) service in a way that will cost them more money, but never convert to and profit. I can always create multiple email accounts, you know. So I don't see how spending development efforts to parse and detect + and . is effective.
- shkkmo 9y agoIt's a pointless and stupid point. It is extremely easy to setup extra email accounts, so preventing people from doing so with slightly less work is pointless. It is stupid because it could prevent someone from using their real, valid email address because it matches another, different, valid email address.
- pfooti 9y agoyeah, I actually use google's plus-email features to help me generate test accounts on some sites or to attribute mail spam to other sites.
- kevin_b_er 9y ago> so it’s impossible without doing DNS lookups to figure out whether someone’s mail provider actually thinks johndoe and john.doe are distinct. The author has announced they believe them to intentionally indistinct and has announce an intent to break handling for any mail servers that consider them unique. All on account of gmail ignoring them? This coupled with their author's intent around + makes me loathe this behavior.
- adrianratnapala 9y agoIt is worse than unnecessary. If people start irrationally doing things like recognizing the '+' then that creates facts on the ground which rational reasons for others to have to recognize the '+' -- except nobody really knows why anyone is doing it or what semantics anyone else is using. Thus the whole thing evolves into mess. So please don't do that. Respect the bytes that be!