3 ms·

It seems like some backend code could easily strip the “+” and everything after it before saving an email to a database. Not sure how viable this is but I’ve al

It seems like some backend code could easily strip the “+” and everything after it before saving an email to a database. Not sure how viable this is but I’ve also never tried it.

rantallion 3y ago
They could, but I'd be surprised if they do. Firstly, we can see that they're using the email exactly as provided (for sending, at least), else filters on the mail we receive wouldn't work. Secondly, the + trick works because it's valid in email addresses under RFC 5321 and RFC 5322 - the fact that Gmail (and others?) direct all addresses of the format 'foo+bar@gmail.com' to the mailbox of 'foo@gmail.com' is a quirk, not a given. Anyone wanting to trim '+bar' would have to know it's safe to do so for particular providers, and I doubt anyone wants to maintain that list and do extra backend work just in case they want to share on the sly.
- qaisjp 3y ago
  I don't think spammers care if trimming the plus-alias doesn't work for some email providers. Gmail is also pretty popular, so it's not much work to just hardcode it there.
legitster 3y ago
That's the trick - not all email providers behave this way, so systems would have to throw out legitimate emails. Also, most of the automated email systems are not as sophisticated as people think. Ours actually relies on + wildcards for internal testing.
- Nextgrid 3y ago
  How many legitimate emails have a + in them and don't use such an alias system? I'm sure they exist, but are probably even less frequent than the amount of people using this alias system, thus it's more profitable to strip it out.
  - legitster 3y ago
    What do you mean by "profitable"? If you are just trying to datamine for random email addresses, you can do that with a random string generator. If you want a list of Netflix customers accounts, you probably want the same exact email they signed up with. Besides, you can always make a Gmail rule to junk any emails coming in without a modifier.
    - Nextgrid 3y ago
      Profitable, whether for the company itself or for some oxygen waster to get some metric ("engagement"?) that justifies their salary/promotion. I'm not saying they will strip out the + from the primary email address used for login/etc - that would be dangerous for many reasons and could deny access to users. But they are absolutely likely to strip it out for obnoxious behavior which is only valuable at scale and individual failures don't matter - such as ad targeting, email spam, etc. In this case, it doesn't matter if you fail to spam the 0.001% of users with + as part of their actual username if it means you manage to spam the 2% that use + as an alias separator.
      - legitster 3y ago
        My career is to build and maintain marketing email systems. So just from my professional advice, it's still a legitimate hack. I'm not saying there is not someone out there trying these shenanigans, but in 95%+ of situations you are still going to catch people sharing your data with a + modifier.
shric 3y ago
I've been using the foo+bar@mydomain trick for over 20 years. I have given this form of email address to well over 1,000 companies and I get exceptionally little spam to foo@mydomain.

It seems like some backend code could easily strip the “+” and everything after it before saving an email to a database. Not sure how viable this is but I’ve also never tried it.

rantallion 3y ago

They could, but I'd be surprised if they do. Firstly, we can see that they're using the email exactly as provided (for sending, at least), else filters on the mail we receive wouldn't work. Secondly, the + trick works because it's valid in email addresses under RFC 5321 and RFC 5322 - the fact that Gmail (and others?) direct all addresses of the format 'foo+bar@gmail.com' to the mailbox of 'foo@gmail.com' is a quirk, not a given. Anyone wanting to trim '+bar' would have to know it's safe to do so for particular providers, and I doubt anyone wants to maintain that list and do extra backend work just in case they want to share on the sly.

qaisjp 3y ago
I don't think spammers care if trimming the plus-alias doesn't work for some email providers. Gmail is also pretty popular, so it's not much work to just hardcode it there.

legitster 3y ago

That's the trick - not all email providers behave this way, so systems would have to throw out legitimate emails. Also, most of the automated email systems are not as sophisticated as people think. Ours actually relies on + wildcards for internal testing.

Nextgrid 3y ago
How many legitimate emails have a + in them and don't use such an alias system? I'm sure they exist, but are probably even less frequent than the amount of people using this alias system, thus it's more profitable to strip it out.
- legitster 3y ago
  What do you mean by "profitable"? If you are just trying to datamine for random email addresses, you can do that with a random string generator. If you want a list of Netflix customers accounts, you probably want the same exact email they signed up with. Besides, you can always make a Gmail rule to junk any emails coming in without a modifier.
  - Nextgrid 3y ago
    Profitable, whether for the company itself or for some oxygen waster to get some metric ("engagement"?) that justifies their salary/promotion. I'm not saying they will strip out the + from the primary email address used for login/etc - that would be dangerous for many reasons and could deny access to users. But they are absolutely likely to strip it out for obnoxious behavior which is only valuable at scale and individual failures don't matter - such as ad targeting, email spam, etc. In this case, it doesn't matter if you fail to spam the 0.001% of users with + as part of their actual username if it means you manage to spam the 2% that use + as an alias separator.
    - legitster 3y ago
      My career is to build and maintain marketing email systems. So just from my professional advice, it's still a legitimate hack. I'm not saying there is not someone out there trying these shenanigans, but in 95%+ of situations you are still going to catch people sharing your data with a + modifier.

shric 3y ago

I've been using the foo+bar@mydomain trick for over 20 years. I have given this form of email address to well over 1,000 companies and I get exceptionally little spam to foo@mydomain.