5 ms·
Gmail trick: multiplying your address
- dkopi 12y ago//TODO: Check user_email for multiple variations of the same account by calculating and storing a canonical e-mail field in the DB as well.
- ch4s3 12y agoyeah, seriously.
- voidlogic 12y agoAssuming you are trying to prevent people from creating multiple accounts on your service... keep in mind they could create e-mail forwarders at other domains, this just stops a very easy method. Also, more importantly, this would have to only apply to a set a whitelisted domains, plenty of non-gmail systems would treat these variations as distinct addresses. So without a set of domains to apply this logic too, you could end up stopping users from registering with their own normal/actual address.
- diggan 12y agoAlso called sub-addressing in RFC 5233[0] or Address Tags. Gmail is not the only one of the email providers that enables this. Yahoo, Apple, Outlook, Fastmail and others also support this. More information at Wikipedia: http://en.wikipedia.org/wiki/Email_address#Address_tags http://en.wikipedia.org/wiki/Email_address#Address_tags [0] https://tools.ietf.org/html/rfc5233 https://tools.ietf.org/html/rfc5233
- pyderman 12y agoNice! Didn't knew that other providers do it aswell.
- maxmcd 12y agoFor #2. The dots are completely irrelevant, so you can actually add and remove. m.axm@gmail.com ma.xm@gmail.com m.ax.m@gmail.com m.a.x.m@gmail.com etc etc etc
- amouat 12y agoI use the + trick, but several signups don't allow the + sign in e-mail addresses.
- lost_name 12y agoI've run into a situation where I was able to sign up using the + in the e-mail, but not login (or unsubscribe from their newletter) with the same address.
- slayed0 12y agoThey probably recognized the + and stripped it, as well as all subsequent characters, from your address upon form entry.
- mod 12y agoThey should probably strip it from the login form, then. As a mediocre web dev, that'd be my next step.
- SippinLean 12y agoSame here, it's quite often, actually. Enough that I won't do it anymore.
- personZ 12y agoHumorous related story -- I was a customer of GM's OnStar service, and had a login on their web portal that I used for account maintenance and to check on vehicle stuff. Sometime later, the GM team rolled out a new version that blocked periods, but my account name had a period. It would happily send me an account recovery email with my now invalid username that I couldn't use. Nor could I configure a new account as it would happily point me to my old, now invalid account. The version without the period did not work. This was a pretty fringe service of negligible value to me, so when my CC changed I sent them an email telling them of this problem, and my inability to change my account. No response. So I let the account expire. Still couldn't believe that a team could make a new presentation that blocked already in place usernames, nor would they do anything about it.
- cfontes 12y agoWhat I want is something like a 10-minute-mail inside my gmail account!!!
- sp332 12y agoYahoo Mail does this. You can make a specific new address and then delete it when you're done. https://help.yahoo.com/kb/mail/SLN3523.html https://help.yahoo.com/kb/mail/SLN3523.html
- thrownaway2424 12y agoFastmail also does this. They have hundreds of domains you can use for disposable accounts.
- pyderman 12y agoYes, that's on my wishlist too!
- sethrin 12y agoI just use mailinator. No charge, no hassle, you don't have to set it up first. Half the time I don't even end up checking it. So far I don't really have a use case for plus addressing.
- paulrr 12y agoI never understood why people rely on the + trick to determine the source of new spam. Wouldn't a smart spammer / list-seller simply strip the suffix from all @gmail.com addresses?
- mbertrand 12y agoI've thought the same thing since I encountered this trick a few years back. My guess is that most email providers don't allow the use of a "+" in the address and as a result its viewed as a fringe case and not accounted for.
- danielweber 12y agoIt's not a valid way to test for illicit spam, but it's a good way to help keep honest people honest. There are researchers who make brand-new addresses and put them in various places as a tripwire for spam.
- PinguTS 12y agoIncomplete Article for old well known stuff: 1. "Gmail has a wildcard for the + sign as it doesn't recognize it nor any characters that follow it." This wrong. It is well documented and called aliasing within Google. There is even a support page for it: https://support.google.com/mail/answer/12096?hl=en https://support.google.com/mail/answer/12096?hl=en 2. Even that is documented: https://support.google.com/mail/answer/8158?hl=en https://support.google.com/mail/answer/8158?hl=en 3. Even that is documented: https://support.google.com/mail/answer/159001?hl=en https://support.google.com/mail/answer/159001?hl=en There are also a lot of ccTLDs that Google has for Gmail. Also those will work.
- pyderman 12y agoYes, you're right about the support pages. I only knew about the "+" sign until now and it seems like lots of people didn't knew about this :)
- danielweber 12y agoNot everyone knows everything. I knew all of this, but lots of people don't. If there's one thing I think I could change about HN, it would be that we'd be easier on people who don't know things. Many times I'll read an article about the new version of PolyDoopWerks, and be told that it's the Uber-of-OOD-builders, and have no idea what's going on.
- kirklove 12y agoSeconded. I like reading and learning here. There is a lot I don't know. And that's cool. Most folks are in the same boat. Thanks for the comment.
- stronglikedan 12y agoI'm relatively new here. While I do run across comments where people seem to be talking down to others, I see that they are mostly in the minority. That is very refreshing, compared to most other sites where intellectual conversations are taking place. I usually just chalk it up to the difficulty in conveying emotion through strictly text. In the case where it is obviously not so, it's easy enough to ignore the person. Basically, there's always going to be one or two of that guy in any conversation. I'm just happy that they're seemingly kept to a minimum on HN.
- aiurtourist 12y agoI highly recommend Sneakemail.com and have been using them for over a decade. They let you set up keywords, like "foo", and then you can mail anything-foo@sneakemail.com (or snkmail.com, since a few sites block the former domain) and it creates an alias. On the Sneakemail web UI you can enable/disable aliases and see recent mail. An alias can forward up to 5 people or so, and when someone sends you mail, if you reply you'll reply through Sneakemail. Of course it's also worth mentioning Mailinator.com (one-off throwaway aliases, but public) and 10minutemail.com (super-disposable temporary email addresses).
- pyderman 12y agoWow, awesome tips! Will check them out and write a follow-up
- ryan-c 12y agoI've also been using sneakemail for at least twelve years. They also let you set up addresses with a bunch of randomly generated letters/numbers that are opaquely mapped to you, but you have to log in to do that. The only problem is that some sites ban their domains - in particular Adafruit does this (they banned existing use of it, not just new sign ups), and their support said basically "we won't whitelist your address even though you've been ordering stuff from us for over five years".
- darkstar999 12y agoAlso try 33mail.com for throwaways. You get a subdomain, so you can do [anything]@foo.33mail.com or [anything]@foo.33m.co
- Thesaurus 12y agoThere's hardly much to gain here.
- thrownaway2424 12y agoIt kinda bugs me when people describe +foo as a "gmail trick". That type of addressing predates gmail, and exists outside of it still. In fact the plus is not the only form of this. qmail uses the dash, and postfix allows you to configure anything as a separator.
- pi-err 12y agoI have found a few sites reject the + in gmail addresses. I also suspect most DB (or wannabe spammners) would know about this and remove anything after the + sign. Same goes for the "." trick. Still good to know though. I'm now using Blur (https://www.abine.com/index.html https://www.abine.com/index.html). Very effective so far at creating aliases pointing to my real email. Only worried on how they'll fund their operations long term.
- penguat 12y agoI'm using the '+' for automating email tests - using that and Gmail's API I can set up asynchronous tests against unique email addresses, and test them as they arrive. This is a crucial part of integration testing with partner companies.
- SippinLean 12y agoEasier to just get a custom domain and set up a catch-all account to forward to your gmail. This way you can do [sender]@domain.com, [company]@domain.com, john1, john2, john3@domain.com and never run out of options. If one starts spamming you can just stop a particular [company]@domain from forwarding.
- sinatra 12y agoKeep in mind that catch-all accounts usually get a lot of random spam. If you're using this domain to signup for various services, at some point, spammers will become aware of it. And, they'll start sending a lot of spam to (random string that spammer comes up with)@your-domain.com.
- PinguTS 12y agoI have catch-all running for a few years now, but no real spam problem. Maybe due to the fact that greylisting still works pretty effective. Most of the spam I receive is on my GMX including the email address I never used for sign-ups of any sort.
- gohrt 12y agoThis is why mail hosts and MX registrars offer spam blocking.
- tzury 12y agoI used to send it at mailing lists and sign-ups. However, I Noticed spammers have learned the trick and omit the "+..".
- rMBP 12y agoI'm running my own email server and use the dash/minus - instead. Works great.
- kps 12y ago> I Noticed spammers have learned the trick and omit the "+..". If you control your own email, 1. Configure a different character, e.g. ‘-’, as your subaddress separator. 2. Set up ‘joe@example.com’ as a spam trap. 3. Set up ‘joe+from@example.com’ as an email address. 4. Provide ‘joe+from-random-signup@example.com’ externally.
- deleted 12y ago[deleted]
- jpalomaki 12y agoAccording to my experience quite many email address validators on web sites don't consider the address with "+" as valid.
- gohrt 12y agoThis is why email is wonderful. It works so well that people are marveling about learning standard features that were deployed before they were born. If only we stuck to a few good ideas instead of overwhelming ourselves and each other with bad ideas.
- jj00 12y agoI'm sorry, but I've grown to hate this feature. I keep receiving emails from accounts I didn't sign up for, only to discover the person (with a similar name) used an email address like "senor.developez@gmail.com" or "senordevelopez" and the site itself defaults to "gmail.com". These are not off-the-wall websites, I've had long conversations with Netflix and a satellite TV service. You'd be surprised how many website do not authenticate the email account given.
- kevin_thibedeau 12y agoThe simple solution to this is to request a password reset from that service and disable their account.
- palehose 12y agoI have an application set up with Devise handling authentication for me and Devise allows me to create multiple accounts with the same email address. Considering how commonly used Devise is for setting up a site with Ruby on Rails, this is a huge open hole for a lot of websites who might not appreciate multiple user accounts tied to the same email.