4 ms·
I don’t get the argument that the email dots stripping should be removed but the “+” tag feature should be kept. Both of them allow infinite email addresses. T
by thephyber 9y ago
I don’t get the argument that the email dots stripping should be removed but the “+” tag feature should be kept.
Both of them allow infinite email addresses. The tag feature is not always available because app developers frequently don’t allow the plus character.
I would prefer that (1) a Netflix require email verification and (2) GMail describe in detail all of the email address features so app developers can explore the security issues around them.
I used to work for a company that dealt with these issues almost 10 years ago. It was also fun when Hotmail and Yahoo started recycling unused email addresses after ~6 months.
- zakk 9y ago> The tag feature is not always available because app developers frequently don’t allow the plus characte Should we stop using a feature because some buggy apps don’t support it?
- BenjiWiebe 9y agoThis is why, on my semi-personal (<10 users) email server I process several different characters as tagging characters: dot, dash, underscore, and plus IIRC.
- techsupporter 9y agoI use a subdomain as catch-all; *@something.example.com all goes to one folder. That way it's impossible for the spammers to know that this is a "sorted" e-mail address since lots of people have e-mail addresses under a subdomain and it's not trivial to filter out like myrealidentity+youareaspammer@example.com turning into myrealidentity@example.com. Other users on my setup can use it, they just have to pick a different "something" if they want to use the same example.com as me.
- Santzes 9y agoMy understanding is + sign is in the RFC, so of course it should be supported. If you want to identify your users by email, you should probably strip the + and everything after before checking for uniqueness. On the other hand, dots matter in the RFC and Gmail is breaking it with their "feature". edit: I was corrected in other comments that the + labeling is optional part of the standard.
- shkkmo 9y ago> I was corrected in other comments that the + labeling is optional part of the standard. Allowing + in emails is not an optional part of the standard. > you should probably strip the + and everything after before checking for uniqueness. No, you shouldn't. Different email providers use different characters to allow "subaddressing" or "tagging" and the presence of those characters doesn't mean that any subaddressing will be done. https://en.wikipedia.org/wiki/Email_address#Subaddressing https://en.wikipedia.org/wiki/Email_address#Subaddressing
- fjsolwmv 9y agoGmail isn't breaking anything. It's none of Netflix's business that Gmail gives its users aliases. This issue has nothing to do with dots, and everything to do with Netflix sending bills to unverified email addresses.
- nebulous1 9y agoAs far as I can tell it isn't in the standard at all, optional or otherwise (although the character '+' is allowable). Gmail are not the only ones to implement this feature though. Also, you'll have to elaborate on how the dot usage actually breaks the RFC. I assume it states that dots are just like any other allowable character, but that's not the same as actually breaking the RFC.
- snarf21 9y agoI must be missing something but the + and . feature both have the same problem for this "scam", right?
- jiveturkey 9y agoRight. Which is exactly what the GP said.
- chii 9y agoa dot looks way less suspicious to a non-technical user. a plus is more jarring, and more likely to incite suspicion.
- abledon 9y agoI'd say most "non-technical" users dont even look at the email address it was sent to. They just assume that since it landed in their inbox, the magic 'computer' knows what its doing and they just need to read their email and reply appropriately.