27 ms·

The "cybersecurity" firm says they are unsure what they can be used to access, but that the usernames are email addresses. If they just look for emails with an

by welder 13y ago

The "cybersecurity" firm says they are unsure what they can be used to access, but that the usernames are email addresses. If they just look for emails with an appended plus sign they can probably find out what service the account is from. For example, john.doe+cloudservice@gmail.com [1] Anyone have a copy of the dump? [1] http://gmailblog.blogspot.com/2008/03/2-hidden-ways-to-get-more-from-your.html http://gmailblog.blogspot.com/2008/03/2-hidden-ways-to-get-m...

malka 13y ago
lots of websites do not consider the '+' character to be invalid for an email (I do not have an example in my mind at the moment). Annoying as hell.
- welder 13y ago
  Then there's always cloudservice@mydomain.com
- joshvm 13y ago
  Almost all websites allow it. The ones that don't are generally fairly restrictive and probably just check is_alnum(). I use it all the time to segregate incoming mail. I have 1Password and generate a random long password for each account, so I'm not particularly concerned if one or multiple accounts are breached. This means I have to trust 1Password of course, but I'll risk it. The problem for me is inconsistent support. For example, when validation allows it, but the server-side strips the +. I recently booked a flight with Monarch (UK super budget), email address: example+monarch@gmail.com This got stripped to examplemonarch@gmail.com which I'm sure doesn't exist for my name. I couldn't change the email because.. surprise.. you need a confirmation email to do it. Fortunately you only need the booking reference and the address to check in, but it was a bit annoying.
taylonr 13y ago
I think that there are a lot fewer people using that feature than you'd assume. Even lots of developer coworkers don't know about that ability, even fewer use it. So I can't imagine there are a lot of non-techie people out there doing john+adobe@gmail.com.
- sp332 13y ago
  Not many, but in 360,000,000 there are probably a few.
- serf 13y ago
  I thought that too, but did you take a look at the last big dump that went public? I think it was the Target one. There were tons of that type of email used. I'm not sure about the percentage, certainly less than ten percent, but when you're talking such sheer volume that does not really matter very much.

by welder 13y ago

malka 13y ago

lots of websites do not consider the '+' character to be invalid for an email (I do not have an example in my mind at the moment). Annoying as hell.

welder 13y ago
Then there's always cloudservice@mydomain.com
joshvm 13y ago
Almost all websites allow it. The ones that don't are generally fairly restrictive and probably just check is_alnum(). I use it all the time to segregate incoming mail. I have 1Password and generate a random long password for each account, so I'm not particularly concerned if one or multiple accounts are breached. This means I have to trust 1Password of course, but I'll risk it. The problem for me is inconsistent support. For example, when validation allows it, but the server-side strips the +. I recently booked a flight with Monarch (UK super budget), email address: example+monarch@gmail.com This got stripped to examplemonarch@gmail.com which I'm sure doesn't exist for my name. I couldn't change the email because.. surprise.. you need a confirmation email to do it. Fortunately you only need the booking reference and the address to check in, but it was a bit annoying.

taylonr 13y ago

I think that there are a lot fewer people using that feature than you'd assume. Even lots of developer coworkers don't know about that ability, even fewer use it. So I can't imagine there are a lot of non-techie people out there doing john+adobe@gmail.com.

sp332 13y ago
Not many, but in 360,000,000 there are probably a few.
serf 13y ago
I thought that too, but did you take a look at the last big dump that went public? I think it was the Target one. There were tons of that type of email used. I'm not sure about the percentage, certainly less than ten percent, but when you're talking such sheer volume that does not really matter very much.