4 ms·
> actually emails with dots in different positions should be different emails Don’t know from where this is coming from but there’s no such _should be_ rule, t
by bad_user 9y ago
> actually emails with dots in different positions should be different emails
Don’t know from where this is coming from but there’s no such _should be_ rule, there never was.
As a matter of fact an email server can have any aliasing setup it wants. FastMail for example does sub-domain aliasing, which is awesome because I can use an unique email address for any service I sign up to.
Any email server or service worth its salt allows aliases. Which aren’t hard to guess for a determined attacker either.
Netflix has no excuse ;-)
- Pxtl 9y agosubdomain aliasing sounds way better than + aliasing. Too many sites block + aliasing.
- gcb0 9y ago> Too many sites block + aliasing. You actually mean: Too many sites were coded by incompetent people and have broken input validation.
- bad_user 9y agoYes, unfortunately that's the truth. For example: meetup.com On an email with a plus in it, they complain with this exact error message: "This isn't a valid email address". I contacted their support a year ago. They replied that they've passed along my "feedback". Nothing happened since then. That said, plus aliasing is sort of a standard. And spammers could eliminate anything after the plus, its usage being pretty obvious, so you can't rely on it for tracing spam. Eliminating the aliasing is much trickier to do with sub-domains, as it's not at all clear when aliasing is used or not. And some email services support custom email routing based on your own regular expressions (e.g. GSuite) so you can come up with your own weird scheme. Plus aliasing is only fine when you don't have control for doing something better, more opaque. Like when you have a work or a @gmail.com address.