4 ms·

If you use gmail, you can use youremail+anything@gmail.com, and it will all get forwarded to youremail@gmail.com. This is incredibly handy for noticing who is s

If you use gmail, you can use youremail+anything@gmail.com, and it will all get forwarded to youremail@gmail.com. This is incredibly handy for noticing who is sending you spam. I'll also use it for sites that I know are going to send me spam, and then immediately create a filter than deletes emails sent to joe+annoyingsite@gmail.com (note: that's not my real email)

flanbiscuit 13y ago
I've found that when signing up for things, a lot sites don't allow the "+" in the email. They'll throw a email validation error. But at one point this was a good technique, I just think many sites have either don't allow it or can easily get around it
kisielk 13y ago
That does nothing to increase the security of your accounts, since effectively the email address is the same.
- oijaf888 13y ago
  It keeps phishing attacks from being able to cross services (since if you get a citibank email to your coinbase email that would be a big flag) and it reduces the attack surface on other sites. I use email.site@domain.com for this purpose and it makes it handy to see who has somehow lost/disclosed my email to third parties and not informed me (FreshDirect for example)
  - kisielk 13y ago
    email.site@domain.com is at least a distinct email address, unlike using +. Especially if you use different passwords for each account, it means if one of the emails is compromised then the attacker can't use it to recover passwords of your other sites.
    - oijaf888 13y ago
      + can be a distinct email address, just as . can be an alias. It really depends on how your email server is configured. Postfix makes it really easy to adjust what character you use.
  - claudius 13y ago
    > It keeps phishing attacks from being able to cross services (since if you get a citibank email to your coinbase email that would be a big flag) and it reduces the attack surface on other sites. Or, more importantly, it lets you authenticate the sender in some way. Citibank has to send you email to you.citibankiscool1253stuffonlyIknow@example.net and it is unlikely for a spammer to guess that exact wording (without also trying hundreds of others, which would give it away by filling your inbox).
crazcarl 13y ago
Does this actually prevent true spammers, or only emails you consider spam, but the sender thinks is worthwhile? Otherwise, as a 'true' spammer, why wouldn't you just always strip off everything after the plus when adding the email to your distribution list?
- claudius 13y ago
  I use _, not "+" and anybody else might use "." or "-" depending on the configuration of their mail server. Sure, you can always add the full email and every possible stripped email to your lists, but in practice, few people seem to do that (judging by the amount of spam I get to me_randomstuff@example.net as compared to me@example.net).
  - SomeCallMeTim 13y ago
    I use "-" with an alias to "_". It turns out that when you give an email address to random people, they sometimes don't know the difference between "dash" or "hyphen" and an underscore.
- wpietri 13y ago
  Depends on how smart the spammer is, and how much they care. Most spammers a) are not very bright, and b) are in a volume business. Even the ones smart enough to do this may not think it worth the time to possibly improve a tiny percentage of harvested addresses. Especially since those of us who are dedicated enough to maintain tagged addresses are unlikely to respond positively to spam no matter what address we receive it on.
jonknee 13y ago
That won't help here, your real Gmail address is exposed which lets everyone know that you have BTC on web wallets.
- eli 13y ago
  Actually it would help you here. In this case your real address isn't exposed unless someone guessed the exact version you used to sign up.
  - jonknee 13y ago
    What do you mean? If joeblow+coinbase@gmail.com is in the leaked list you know that that joeblow@gmail.com is the "real" user and also is someone who has BTC.
    - eli 13y ago
      There was no leak. The API allowed you to see whether a given email had an account associated, so someone churned through a big list of known email addresses to find accounts.
- ttty 13y ago
  If you do a filter like this: All mail that arrives to john.s.m.i.t.h@gmail.com is important. Everything else is spam. Of course you might not get emails from people who sends emails to john.smith@gmail.com nor johnsmith@gmail.com because the emails go to spam.
Uehreka 13y ago
I'm kind of surprised that this still works. I would guess that diligent spammers will soon catch on and start stripping anything that comes after the + sign.
thetrb 13y ago
In general spammers deal with those things pretty quickly. They can just quickly add a regex to remove everything starting with the "+" and then you don't have any unique identifier any more.

flanbiscuit 13y ago

I've found that when signing up for things, a lot sites don't allow the "+" in the email. They'll throw a email validation error. But at one point this was a good technique, I just think many sites have either don't allow it or can easily get around it

kisielk 13y ago

That does nothing to increase the security of your accounts, since effectively the email address is the same.

oijaf888 13y ago
It keeps phishing attacks from being able to cross services (since if you get a citibank email to your coinbase email that would be a big flag) and it reduces the attack surface on other sites. I use email.site@domain.com for this purpose and it makes it handy to see who has somehow lost/disclosed my email to third parties and not informed me (FreshDirect for example)
- kisielk 13y ago
  email.site@domain.com is at least a distinct email address, unlike using +. Especially if you use different passwords for each account, it means if one of the emails is compromised then the attacker can't use it to recover passwords of your other sites.
  - oijaf888 13y ago
    + can be a distinct email address, just as . can be an alias. It really depends on how your email server is configured. Postfix makes it really easy to adjust what character you use.
- claudius 13y ago
  > It keeps phishing attacks from being able to cross services (since if you get a citibank email to your coinbase email that would be a big flag) and it reduces the attack surface on other sites. Or, more importantly, it lets you authenticate the sender in some way. Citibank has to send you email to you.citibankiscool1253stuffonlyIknow@example.net and it is unlikely for a spammer to guess that exact wording (without also trying hundreds of others, which would give it away by filling your inbox).

crazcarl 13y ago

Does this actually prevent true spammers, or only emails you consider spam, but the sender thinks is worthwhile? Otherwise, as a 'true' spammer, why wouldn't you just always strip off everything after the plus when adding the email to your distribution list?

claudius 13y ago
I use _, not "+" and anybody else might use "." or "-" depending on the configuration of their mail server. Sure, you can always add the full email and every possible stripped email to your lists, but in practice, few people seem to do that (judging by the amount of spam I get to me_randomstuff@example.net as compared to me@example.net).
- SomeCallMeTim 13y ago
  I use "-" with an alias to "_". It turns out that when you give an email address to random people, they sometimes don't know the difference between "dash" or "hyphen" and an underscore.
wpietri 13y ago
Depends on how smart the spammer is, and how much they care. Most spammers a) are not very bright, and b) are in a volume business. Even the ones smart enough to do this may not think it worth the time to possibly improve a tiny percentage of harvested addresses. Especially since those of us who are dedicated enough to maintain tagged addresses are unlikely to respond positively to spam no matter what address we receive it on.

jonknee 13y ago

That won't help here, your real Gmail address is exposed which lets everyone know that you have BTC on web wallets.

eli 13y ago
Actually it would help you here. In this case your real address isn't exposed unless someone guessed the exact version you used to sign up.
- jonknee 13y ago
  What do you mean? If joeblow+coinbase@gmail.com is in the leaked list you know that that joeblow@gmail.com is the "real" user and also is someone who has BTC.
  - eli 13y ago
    There was no leak. The API allowed you to see whether a given email had an account associated, so someone churned through a big list of known email addresses to find accounts.
ttty 13y ago
If you do a filter like this: All mail that arrives to john.s.m.i.t.h@gmail.com is important. Everything else is spam. Of course you might not get emails from people who sends emails to john.smith@gmail.com nor johnsmith@gmail.com because the emails go to spam.

Uehreka 13y ago

I'm kind of surprised that this still works. I would guess that diligent spammers will soon catch on and start stripping anything that comes after the + sign.

thetrb 13y ago

In general spammers deal with those things pretty quickly. They can just quickly add a regex to remove everything starting with the "+" and then you don't have any unique identifier any more.