5 ms·
Boy I sure am glad that Ticketmaster refused to let me change my email address some months back when I was trying to clean up my profile and change the register
by AdmiralAsshat 2y ago
Boy I sure am glad that Ticketmaster refused to let me change my email address some months back when I was trying to clean up my profile and change the registered address from my_handle@gmail.com to my_handle+ticketmaster@gmail.com.
- throw0101d 2y ago> […] from my_handle@gmail.com to my_handle+ticketmaster@gmail.com. Webdevs of HN: how many of you make a point of allowing sub-addressing? * https://en.wikipedia.org/wiki/Email_address#Sub-addressing https://en.wikipedia.org/wiki/Email_address#Sub-addressing
- oarsinsync 2y agoWhy would you need to make a point of allowing sub-addressing? Surely it’s whether or not you make a point of disallowing it?
- mrsilencedogood 2y agoI work at a place that just recently clamped down on this. We decided to normalize the emails so that we have a column in the db like "email" and then also "normalized_email" where normalized_email has a unique key on it too. This way, people can still make their email look like whatever they want, but they also only get 1 per email inbox. This was all because people were doing abuse more easily by churning lots of accounts while only needing 1 gmail address. Plugging this gap was a huge deal for us in reducing card testing problems.
- mynameisvlad 2y agoWe’ve done this for a long while too. You can use subaddressing, but you’re still limited to one account per “base email”. We also normalize dots and other methods of reusing an email account.
- ryandrake 2y agoJust changing the delimiter would probably thwart most efforts like this. I self host so am not limited to the + character. So, I currently use name-subaddress@domain. I could easily switch to using underscore as my delimiter. Or I could just use subaddress@domain. This is dead simple and I don’t even have commercial motivation. Good luck!
- mynameisvlad 2y agoI mean, sure, but it does thwart the vast majority of users who don’t even know this is an option. Most people don't know you can have an email from someone other than the major providers, let alone on a custom domain or selfhosted. At the end of the day, nothing will thwart a determined person. But that’s not the goal. If it deters the vast majority of your users from making duplicate accounts, then it’s still a success. Perfect is the enemy of good, after all.
- xp84 2y agoYes, and another super cool thing is the prevention of accidental screwups where someone typos their email. If the typo collides with an existing account after normalization, it could be (correctly) rejected. Without this normalization index, you could have ronx@gmail pre-existing, someone trying to type "rob.x" typos "ron.x" -- and now a bunch of emails start going out to poor "ronx" (who often doesn't understand what's going on, thinks his account is 'hacked,' etc. Ideally, the system would (for Gmail addresses) reject "ron.x" knowing it's basically tied to an existing user.
- Marsymars 2y ago> We also normalize dots and other methods of reusing an email account. Is that limited by domain? gmail's dot handling isn't at all standard; e.g. john.doe@outlook.com and johndoe@outlook.com are different accounts, as are john.doe@icloud.com and johndoe@icloud.com.
- mynameisvlad 2y ago
- Mavvie 2y agoThis sounds like a very nice compromise actually. I'm surprised it helped with abuse though, since there's a lot of email providers that are easier to create an account with than gmail.
- mariusor 2y agoIt's trivial to defeat though, all you need is your own domain and an email provider that supports catch all email addresses.
- mrsilencedogood 2y agoA big part of handling abuse is to recognize that you cannot win - all you can do is better. And a big part of abuse is just raising the bar of sophistication required to abuse you. We went from "any random script kiddie with a gmail account gets infinite accounts easily" to "now someone has to use a custom email domain" (which is easy for us to just banhammer the domain), which both requires sophistication and money. And it makes the banhammer-swing more on par with the amount of effort they have to put in to evade it - banning the domain means go find another domain and pay another registrar fee.
- contravariant 2y agoYou could 'accidentally' prevent it by enforcing some incorrect regexp like [a-zA-Z0-9]@[a-z.]+ Not allowing a '+' to appear in the local part is not even that unreasonable. It's against the standard, but then "My email is this@example.com"@example.com is valid according to the standard so take the standard with a grain of salt.
- Timon3 2y agoWhat's the issue with "My email is this@example.com"@example.com? Why disallow it, or use it to argue that the standard isn't good?
- throw0101d 2y ago> Why disallow it, or use it to argue that the standard isn't good? Because lots of folks fat finger their own e-mail addresses and then complain that a 'site sucks' because signing up doesn't work. Sanity checking to protect people against themselves may be treated as a form of UX: it's probably why some forms insist you type (not copy-paste) your e-mail twice.
- xp84 2y agoI'm perpetually flabbergasted by how anyone thinks this "no pasting" thing is a pro-accuracy idea. As though people would be copying from a bad source. I see this a lot on forms for bank account numbers -- maybe one of the least amenable formats to visually copying down and retyping, since they're never written with delimiters or punctuation. I store them in my password manager, and then some idiotic form wants me to type my 18-digit bank account number, twice, on my phone, where I can't see more than one application at a time.
- contravariant 2y agoIt's just to illustrate that the standard is more complicated than people might realise. I think you'll have problems getting most systems to accept an email address with two @s in it, but I might be wrong. Either way it would definitely break some (not too well written) code. Though if possible I'd err on the side of being too permissive rather than too restrictive. In the end the only true way to validate an address is to send it an email.
- meowster 2y agoI set up a domain with a catchall email, and give every service different letters/numbers.
- codetrotter 2y agoI use iCloud mail. It generates new addresses for me for different services. The generated addresses are all completely distinct, and can be revoked. They look like for example: happy.wombat-0a@icloud.com dingus-capybara.0e@icloud.com
- nikcub 2y ago1password has support for a custom domain. I bought an old generic webmail provider domain that is now defunkt and use that. I also use random name aliases on each signup. Even if you aggregate multiple breaches I doubt anybody would link it to an individual (me). The big remaining issue is payments. I use multiple cards and rotate them regularly (I don't have access to privacy.com or similar where I am based). I believe this is the future - feed each service you signup to a new set of information and keep track in a password managers. Most services don't care what your real name is (I've been using an alias on services like Uber for ~10+ years). icloud is also a good option - but I don't want to signal being an iCloud user.
- meowster 2y agoYou have to generate addresses before you can use them. That doesn't seem very convenient.
- ZekeSulastin 2y agoAt least on iOS, you’re given a “Hide My Email” option when you’re on a sign up page that generates the new address right when you need it.
- xp84 2y agoI've been encountering lately a surprising number of deliverability problems (as in, the emails never arrive) when I try to use "Hidden" icloud emails and Outlook.com aliases. Switching to gmail suddenly confirmations arrive. It's frustrating. Sample size of a few, but I am starting to think that companies who aren't Google are starting to lose the spam war in a way that is leading to blackholing valid messages :(
- free_bip 2y agoThe actual relevant question is: how many of you make a point of disallowing this? You have to go out of your way to make that not work, given that + is a valid character in email addresses.
- throw0101d 2y ago> You have to go out of your way to make that not work, given that + is a valid character in email addresses. Per another comment, all one would need for it to not work is have a regex of [a-zA-Z0-9]@[a-z.]+, or using POSIX-compat, [:alnum:]. * https://en.wikipedia.org/wiki/Regular_expression#Character_classes https://en.wikipedia.org/wiki/Regular_expression#Character_c...
- nielsole 2y ago> [a-zA-Z0-9]@[a-z.]+ Only a small minority of my email addresses I've ever had matches that pattern.
- throw0101d 2y ago> Only a small minority of my email addresses I've ever had matches that pattern. The example is illustrative, and not definitive, as to how the simple and innocuous decision about a regex can determine functionality, and it is not about someone going "out of your way to make that not work" to break things.
- dxdm 2y agoI don't know if that's what you're trying to say, but what it illustrates to me is how easy it is to quickly cook up a simple regex to filter out certain patterns in email addresses and feel like it's doing the job, while unintentionally breaking things for a large number of people you don't have on your radar.
- throw0101d 2y ago
- philote 2y agoAt my current employer we do allow this. It's handy for testing and not a big deal if we have users doing this to make multiple accounts (they don't gain anything by doing that). But at a previous job it was a bigger deal and we'd strip off the sub-address part because we were trying to match up email addresses across client sites (this was due to a bit of a shady thing the company was doing and part of the reason why I left).
- Mavvie 2y agoWell, you have to go out of your way to prevent it. The sub-addressing complexity is on the email provider side; ticketmaster doesn't have to do anything for it to work except not reject valid email addresses. In my experience, most but not all sites will accept "+" email addresses.
- cush 2y agoBased on my experience, this feature might as well not exist.
- fetzu 2y agoI’m intrigued how it would have made a difference, wouldn’t it be extremely trivial to “clean up” the dataset by just doing a regex and removing all the “+*”. Or are scammers that lazy? Maybe I’m missing something?
- prettyStandard 2y agoLook at all the comments from the web devs saying they don't go out of their way to disallow this. Their situation is about the same as here.
- Enginerrrd 2y agoIt's just an edge case you'd have to devote brainpower and resources to. It may not be a big commitment, but if it only nets you an additional 0.25% valid email addresses or something, it's probably not going to get done.
- josefresco 2y agoYou can also use my.handle@gmail.com which I use (with a filter to trash immediately) when I need to sign up for something with a high likelihood of spamming me.
- xp84 2y agothe neater thing about the period method is how no one else but you can know which (if any) position(s) of the period are the "good" one(s) and which are the "giving away that it's likely spam" ones.
- listenallyall 2y agoEven if accepted, Google-style plus addressing seems worthless in most situations, as it is trivial to simply remove the plus sign and everything after it to get your native email address.