6 ms·
"+merchant" doesn't do squat to prevent bad actors from selling your email address. Anyone so inclined to sell your address would just strip off the postfix sin
by ryandvm 7y ago
"+merchant" doesn't do squat to prevent bad actors from selling your email address. Anyone so inclined to sell your address would just strip off the postfix since they know it's unnecessary per the spec.
- cbsks 7y agoPer what spec? Having “a+b” deliver to address “a” is Gmail specific, as far as I know.
- cachvico 7y agoRFC 5233: Sieve Email Filtering: Subaddress Extension https://tools.ietf.org/html/rfc5233 https://tools.ietf.org/html/rfc5233 Not Gmail-specific. Labels however are ;)
- cbsks 7y agoThanks! I did not know it was a standard!
- tekknik 7y agoIt’s called subaddress extension: https://tools.ietf.org/html/rfc5233 https://tools.ietf.org/html/rfc5233 Can confirm what parent poster is saying, we remove them on signup.
- nprateem 7y agoI wonder whether that's GDPR compliant. If I give you permission to contact me on me+alias@example.com and you strip off +alias and then contact me on me@example.com, you've inferred data about me I haven't explicitly given you. One could argue that's in a similar ballpark to running a geoIP lookup and then sending me mail through the post.
- frenchy 7y agoIt seems rude (like if I told you to drop off a package at my back door and you put it by the front door), but I given the existence of RFC 5233 I don't see how this would be "data about me I haven't explicitly given you". Also, if you try to mail people based on GeoIP data, you're going to have a bad time.
- nprateem 7y agoIt's about permission. If I give a company a certain set of contact details, and they run some process to find other ways to contact me that seems unfair and beyond what I've given permission for. The fact that it's trival to find my real email from an alias I think is irrelevant - it's still an abuse of trust. Like I say, I can see a correlation with more invasive methods of finding other ways to contact me that I hadn't granted the company (imagine if they start contacting you on social media just because they could look up your profile from your name). You could argue that a major feature of the GDPR is to legislate that just because a company can do something, doesn't mean it's allowed to do it.
- oarsinsync 7y agouser+detail@domain.com user@domain.com The 'detail' is optional, and doesn't infer any privacy. It's kind of like if you get mail delivered to: nprateem, office 2, university of ycombinator and instead they only store: nprateem, university of ycombinator Odds are, mail will still be delivered to you, but it might not come to office 2, and might come to office 1 instead. It's not what you wanted, but there's absolutely no impact to your privacy by them stripping away additional details.
- nprateem 7y agoIf you decide you no longer want to receive email from user+detail@domain.com it's easy to set up a blacklist filter. If they circumvent that and email you at user@domain.com you've lost that alias and easy way of blacklisting them. And presumably if someone had wanted to be contacted at user@domain.com they would have provided that email in the first place. So I don't think your analogy holds.
- hutattedonmyarm 7y ago> we remove them on signup. But why?
- tekknik 7y agoto avoid duplicate user signup. allowing the + would not allow me to use a unique constraint for email address on the user table and be sure an email is only used once.
- alanh 7y agoGmail ignores (or ignored?) dots on the left of the @, so some.person@gmail.com and someperson@gmail.com and s.om.e.person@gmail.com all went to the same inbox. That is gmail-specific.
- bscphil 7y agoOne of the many advantages of using a hosted solution with your own domain is that you can receive email from arbitrary addresses in the same inbox. For example merchant1@inboxname.mydomain.com gets sent to my inbox at Fastmail. inboxname@mydomain.com doesn't exist, so there's no way to get my "real" email address from what I give out to merchants. If I start getting spam on an address, whoops, you and everyone you sold my email to get sent to a black hole in the cloud.
- JustSomeNobody 7y agoThis is called subdomain addressing or subdomain stripping in case anyone wants to look up how to do this with your hosting provider.
- CaptainMarvel 7y agoIf you email me without the +merchant postfix I gave you, your email will go into the trash without me even knowing you sent it.