8 ms·
Now if only websites will stop rejecting plus-addressed email addresses as invalid. The most frequent offenders are mom & pop websites that you just _know_ are
by Hnrobert42 6y ago
Now if only websites will stop rejecting plus-addressed email addresses as invalid. The most frequent offenders are mom & pop websites that you just _know_ are going to get breached.
- beagle3 6y agoThat's not going to help, since everybody knows you can just strip everything after the '+' and get to the main mailbox.
- Already__Taken 6y agoJokes on them, if my spam+<tag> doesn't have a tag it's straight in the bin.
- lucb1e 6y agoIt's always a cat and mouse game, user+$RANDOM@example.org would still get through and you'd not be able to block that based on the sender (assuming you do it like most people, blacklist-based, rather than allocating new email addresses when you need them). Of course, this only becomes an issue when the masses start doing it. I'm very surprised how few spammers remove tge +tag, given that that's semi-mainstream by now.
- em-bee 6y agoyou could track your +labels and reject any unknown ones. personally i don't worry about spam, i want to track who leaks their users email addresses, and then be able to filter on labels that have gone bad
- hawski 6y agoI do prefix+12RandomLetters@blahblah and every potential sender gets it's own random address. Then I use filters to move mail to predefined folders. What's left is spam. If a mail comes in from an unknown sender to known address I know that the address is compromised. Ideally I would like to plug my password manager to generate an address and automatically add email filters in place. Although I was thinking about a service that would just give randomalphanumeric@example.com for all its users, so they would be on the same host and no connection between addresses could be implied. It could or even should be receive only.
- kevin_thibedeau 6y ago'+' has no standardized meaning. Just put the tag first and let them strip off the unimportant part.
- beagle3 6y agoThat's easy if you run your own mail server, but how do you apply that to your Gmail, Gsuite, Outlook, Fastmail or Yahoo mail account?
- amf12 6y agoYou can also use this with a "." (email.spam@gmail.com) in Gmail.
- PetahNZ 6y agoNo, you cant.
- LandR 6y agoThis doesn't work for me bar.foo@gmail.com gets rejected as email address doesn't exist when my gmail is bar@gmail.com
- Namidairo 6y agoThat's because the email in fact went to barfoo@gmail.com, not bar@gmail.com So if you wanted to use it like this you would try something like b.ar@gmail.com
- inanutshellus 6y agoPeriods are ignored in gmail and anything after a + is also ignored, so all of these will go to the same mailbox: johndoe@gmail.com john.doe@gmail.com j.o.h.n.d.o.e@gmail.com johndoe+spam@gmail.com john....doe+spam@gmail.com but johndoe.spam@gmail.com wouldn't go to the same mailbox.
- pi-err 6y agojohn...doe@gmail.com doesn’t seem to work though. I don’t think Gmail takes multiple dots.
- chrismorgan 6y agoNot just Gmail, that’s a syntactically invalid email address. See https://en.wikipedia.org/wiki/Email_address#Local-part https://en.wikipedia.org/wiki/Email_address#Local-part for details. But sure, you could have `(my name is)john."..".doe+spam(...)@gmail.com` if you wanted to. Syntactically valid! The parenthesised bits would be stripped out before sending, and I have no idea whether Gmail would be willing to accept the quoted dots bit.
- isoprophlex 6y agoI use shopname@firstname.lastname.email, with my own lastname.email domain. Fastmail makes configuring your dns records for this super simple. It's always fun interacting with customer service reps when they for example confirm my email address... "errrrrr yeah so we email you at ourname@...?"
- jnwatson 6y agoI've done that for nearly twenty years now. Importantly, it allows one to trace how your email gets distributed and stolen.
- grok22 6y agoDid you find anything interesting? I started doing this recently and did not find anyone misusing my email so far and am now wondering if it's worth the extra effort.
- rrauenza 6y agoA decade ago I found the unique email address I used at Hertz.com leaked for spam. Of course when I complained they said it must have been something I did...
- oneplane 6y agoFor alias addresses they are filtering that because the data thiefs and middlemen know a small portion of people do this. They cut off the plus or dot part when your domain has a well known MX/MTA connected to it. That still leaves custom mailservers and non-alias (as in aliases via plus or dot, not actual mailserver aliases) which does give an indication as to who is sharing your data.
- lozaning 6y agoI own fakefakefake.email and savor the opportunity to give people dumb catchalls when they insist on needing an email address from me.
- fisherjeff 6y ago
- paledot 6y agoThe other problem I ran into is spam+sitename@mydomain.com is really awkward to read over the phone. I ended up switching to sitename@email.mydomain.com, which passes all validators and doesn't sound as sketchy. Using a subdomain, I don't seem to catch any of the spam that gets targeted to catchall domain addresses. Also, I once encountered a site where spam+xyz worked for signup but failed validation on the login form. I think it was something important too, like a utility or bank.
- mrlala 6y agoOdd that you are talking about security breaches with this.. I figured sites wouldn't want to accept it because they know you are most likely filtering their emails so they have a much less chance of getting through to you. If someone is stealing emails/passwords from a site obviously they will just strip characters after the plus to obtain your normal email address?
- 6c696e7578 6y agoI use qmail, where - has been the extension for, well, since it was created. If you're a postfix person, you can use + or -, with recipient_delimiter. You're less likely to bump into issues with -. Some shops don't like their trade name in the email, so rot13 (g? in vim) solves that if your goal is to trace back the leaks. I have not found a reliable way of auto dropping mail from bad sources, sometimes companies change name which makes it hard to validate From with recipient.
- aclindsa 6y ago> If you're a postfix person, you can use + or -, with recipient_delimiter. Even better: postfix and dovecot (as of v2.3) now both allow specifying multiple recipient delimiters. So if you run your own mail server you can specify as many recipient delimiters and switch between them if websites are being picky.
- gumby 6y agoI simply changed my mail configuration to use a different character, in my case _ though X would have worked as well. I wish seive were better supported in mail clients. It works fine on the back end, but I edit my .seive file by logging into the server and sparking up Emacs rather than being able to handle it directly from my mail client.
- girzel 6y agoEmacs can be used to edit sieve files directly on the server, with M-x sieve-manage, so long as you have the managesieve daemon running.
- parliament32 6y agoI use the managesieve plugin in claws-mail, works great with no issues.