6 ms·

If you don't do this your system may allow users to sign up for multiple accounts and double-dip on signup benefits, free trials and other "one per account" fea

If you don't do this your system may allow users to sign up for multiple accounts and double-dip on signup benefits, free trials and other "one per account" features. (Barring additional controls, of course).

eli 9y ago
Well, that's always a risk. The thing this guards against is someone accidentally creating two accounts with variations on the same address and being very confused.
- chii 9y ago
  i recall Amazon did something quite amazing, which is to suggest to the user who signed up twice whether an existing account is the same. but only after they've purchased!
aeruder 9y ago
Or they could just sign up at one of the numerous free email providers with a different username. Stripping the + suffixes is only providing one thing - pain for the users that want to use it.
- slhck 9y ago
  The author suggests stripping the part before doing the uniqueness check. This does not mean that the username (email address in this case) would not be allowed.
  - bdhess 9y ago
    It would for the second user whose address resolves to the same result from the “uniqueness” check.
    - coredog64 9y ago
      I wish this would happen. There's a "rocket surgeon" on the East Coast who has (tried) to sign up for Facebook, Twitter, Steam, and a bunch of sleazy 'message gurlz now' apps using my Gmail address without the period. Obviously it never works, as I get the "I see you're trying to create a new account" email, but one of these days he's going to figure out a way to take over one of those accounts and then I'll really be fked.
      - reaperducer 9y ago
        I have a similar problem with someone who keeps (hopefully accidentally) putting my landline number into Facebook, then I get a call with a recording asking me to press some number to verify my Facebook account.
      - bdhess 9y ago
        I don’t understand your complaint. Google resolves the addresses john.smith@gmail.com and johnsmith@gmail.com to the same account, which you control. (1.) What are you imagining is the attack vector exactly? (2.) Are you asserting that all website owners should build to Google’s (non-standard) behavior?
    - joshmanders 9y ago
      I'm curious as to who would use a service someone else is using, sharing their email but with a local addition? Can me and my wife both sign up to HN and use my email but hers be josh+swife@joshmanders.com and mine be josh@joshmanders.com? That's a strange usecase, isn't it?
      - pinkythepig 9y ago
        gmail makes josh@... and josh+swife@... resolve to the same thing, but there is no guarantee that all other email services behave like that. For all you know, there is an email service that lets you register an email like that, so you have 2 users now whose email is: john+smith@... and john+brown@...
- sodapopcan 9y ago
  It's way easier to write a script to generate thousands of variations on the same email address than to sign up for a thousand different accounts. I've actually been bitten by this bug before... or rather, my company was bitten by an affiliate who neglected to sanitize their emails this way and someone was able to create thousands of gift cards in our system. Having said that, in development, it's super nice to be able to create addresses with +'s in them.
  - pzxc 9y ago
    What you say is not untrue, but it's still bad advice to do it -- a security red herring. First of all, you don't know that 100% of mail servers ignore characters after the +, so you can't safely strip those characters or you might not end up with a usable email address. That goes double for stripping the dots/periods, which gmail ignores but many other mail servers do not. On top of that, it's just as easy to set up a catchall email address -- an email box that accepts all mail for a domain, literally anything@mydomain.com. So a malicious actor could sidestep this security attempt with minimal effort, but it still inconveniences legitimate users despite being worthless from a security perspective.
    - sodapopcan 9y ago
      True, true. As I mentioned below, in my case, it was even usernames, just entering you email for a free gift card. The attacker actually used dots with a gmail address.
      - shkkmo 9y ago
        There are soooo many ways to easily game the email side of it that you would be better off using other means of detecting uniqueness (rate limit per IP address, rate limit per hash of IP address and user-agent)
  - Nadya 9y ago
    >It's way easier to write a script to generate thousands of variations on the same email address than to sign up for a thousand different accounts. It's just as easy to write a script to use ephemeral hosts that you don't need to sign up for. Things like Mailinator. All it does is irritate people like me who use +words as prefilters for email (and to see which companies are selling my email/user data).
- reaperducer 9y ago
  This is true. I know someone who says she's been doing the Hulu free month thing for a couple of years, and does it for other services as well. It's all too much for me to keep track of, but for some people it's no big deal to create new e-mail addresses every month.
tjoff 9y ago
If you as a service provider can't accept that you shouldn't be offering those free trials / benefits at all. This isn't an issue.
etxm 9y ago
You’re gonna be sad to know that mailinator[1] and it’s 100s of domain aliases exist. You’re fighting the wrong battle. [1] https://www.mailinator.com/ https://www.mailinator.com/
- jcomis 9y ago
  Some places check for these types of services though
  - zingmars 9y ago
    They do, but they're not very effective. They might have an up-to-date list of domains belonging to the big services (i.e. Mailinator), but you can always just google "Disposable e-mail", open the 10th page and pick the first one, and it's pretty much always guaranteed to work.
    - jstarfish 9y ago
      I beg to differ. I use this blacklist and not much gets by. Anything that does, I blacklist manually. https://github.com/martenson/disposable-email-domains/blob/master/disposable_email_blacklist.conf https://github.com/martenson/disposable-email-domains/blob/m... A lot of sites I've come across lately are going back to the old-school way of only whitelisting email addresses from .edu domains or ISP accounts ("@comcast.net").
      - antihero 9y ago
        That's an absolutely ridiculous idea and a good way to destroy the amount of users you're getting. Do you whitelist Gmail? Then it's piss simple to sign up to multiple accounts. Do you not? Good luck a massive portion of the internet to sign up...
        jstarfish 9y ago
        I don't want the sort of users who are signing up to perform financial transactions using services like mailinator and guerrillamail. It's always fraudulent. Gmail itself is allowed, but the addresses are normalized. I'm well aware of its potential for abuse.

eli 9y ago

Well, that's always a risk. The thing this guards against is someone accidentally creating two accounts with variations on the same address and being very confused.

chii 9y ago
i recall Amazon did something quite amazing, which is to suggest to the user who signed up twice whether an existing account is the same. but only after they've purchased!

aeruder 9y ago

Or they could just sign up at one of the numerous free email providers with a different username. Stripping the + suffixes is only providing one thing - pain for the users that want to use it.

slhck 9y ago
The author suggests stripping the part before doing the uniqueness check. This does not mean that the username (email address in this case) would not be allowed.
- bdhess 9y ago
  It would for the second user whose address resolves to the same result from the “uniqueness” check.
  - coredog64 9y ago
    I wish this would happen. There's a "rocket surgeon" on the East Coast who has (tried) to sign up for Facebook, Twitter, Steam, and a bunch of sleazy 'message gurlz now' apps using my Gmail address without the period. Obviously it never works, as I get the "I see you're trying to create a new account" email, but one of these days he's going to figure out a way to take over one of those accounts and then I'll really be fked.
    - reaperducer 9y ago
      I have a similar problem with someone who keeps (hopefully accidentally) putting my landline number into Facebook, then I get a call with a recording asking me to press some number to verify my Facebook account.
    - bdhess 9y ago
      I don’t understand your complaint. Google resolves the addresses john.smith@gmail.com and johnsmith@gmail.com to the same account, which you control. (1.) What are you imagining is the attack vector exactly? (2.) Are you asserting that all website owners should build to Google’s (non-standard) behavior?
  - joshmanders 9y ago
    I'm curious as to who would use a service someone else is using, sharing their email but with a local addition? Can me and my wife both sign up to HN and use my email but hers be josh+swife@joshmanders.com and mine be josh@joshmanders.com? That's a strange usecase, isn't it?
    - pinkythepig 9y ago
      gmail makes josh@... and josh+swife@... resolve to the same thing, but there is no guarantee that all other email services behave like that. For all you know, there is an email service that lets you register an email like that, so you have 2 users now whose email is: john+smith@... and john+brown@...
sodapopcan 9y ago
It's way easier to write a script to generate thousands of variations on the same email address than to sign up for a thousand different accounts. I've actually been bitten by this bug before... or rather, my company was bitten by an affiliate who neglected to sanitize their emails this way and someone was able to create thousands of gift cards in our system. Having said that, in development, it's super nice to be able to create addresses with +'s in them.
- pzxc 9y ago
  What you say is not untrue, but it's still bad advice to do it -- a security red herring. First of all, you don't know that 100% of mail servers ignore characters after the +, so you can't safely strip those characters or you might not end up with a usable email address. That goes double for stripping the dots/periods, which gmail ignores but many other mail servers do not. On top of that, it's just as easy to set up a catchall email address -- an email box that accepts all mail for a domain, literally anything@mydomain.com. So a malicious actor could sidestep this security attempt with minimal effort, but it still inconveniences legitimate users despite being worthless from a security perspective.
  - sodapopcan 9y ago
    True, true. As I mentioned below, in my case, it was even usernames, just entering you email for a free gift card. The attacker actually used dots with a gmail address.
    - shkkmo 9y ago
      There are soooo many ways to easily game the email side of it that you would be better off using other means of detecting uniqueness (rate limit per IP address, rate limit per hash of IP address and user-agent)
- Nadya 9y ago
  >It's way easier to write a script to generate thousands of variations on the same email address than to sign up for a thousand different accounts. It's just as easy to write a script to use ephemeral hosts that you don't need to sign up for. Things like Mailinator. All it does is irritate people like me who use +words as prefilters for email (and to see which companies are selling my email/user data).
reaperducer 9y ago
This is true. I know someone who says she's been doing the Hulu free month thing for a couple of years, and does it for other services as well. It's all too much for me to keep track of, but for some people it's no big deal to create new e-mail addresses every month.

tjoff 9y ago

If you as a service provider can't accept that you shouldn't be offering those free trials / benefits at all. This isn't an issue.

etxm 9y ago

You’re gonna be sad to know that mailinator[1] and it’s 100s of domain aliases exist. You’re fighting the wrong battle. [1] https://www.mailinator.com/ https://www.mailinator.com/

jcomis 9y ago
Some places check for these types of services though
- zingmars 9y ago
  They do, but they're not very effective. They might have an up-to-date list of domains belonging to the big services (i.e. Mailinator), but you can always just google "Disposable e-mail", open the 10th page and pick the first one, and it's pretty much always guaranteed to work.
  - jstarfish 9y ago
    I beg to differ. I use this blacklist and not much gets by. Anything that does, I blacklist manually. https://github.com/martenson/disposable-email-domains/blob/master/disposable_email_blacklist.conf https://github.com/martenson/disposable-email-domains/blob/m... A lot of sites I've come across lately are going back to the old-school way of only whitelisting email addresses from .edu domains or ISP accounts ("@comcast.net").
    - antihero 9y ago
      That's an absolutely ridiculous idea and a good way to destroy the amount of users you're getting. Do you whitelist Gmail? Then it's piss simple to sign up to multiple accounts. Do you not? Good luck a massive portion of the internet to sign up...
      - jstarfish 9y ago
        I don't want the sort of users who are signing up to perform financial transactions using services like mailinator and guerrillamail. It's always fraudulent. Gmail itself is allowed, but the addresses are normalized. I'm well aware of its potential for abuse.