Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to get gmail.com banned (2011)

mailinator.blogspot.com

Post reply on HN
Print view View original

41–50 of 65 posts

Re: How to get gmail.com banned (2011)

#41

Post by cosmotron »

michaelhoffman wrote: post #33
paulmd wrote: post #19

Earlier quoted context omitted.

Many sites won't accept email addresses with + in them, because many devs have extremely wrongheaded ideas about validation. I used to have a first.m.last@university.edu address and that one was touch-and-go as well due to the fact that the mailbox had two .'s in it. I actually had to file a support request to get Amazon Student to accept it, even. Nobody from a university with that scheme ever registered before? For…

What's worse: some sites accept email addresses with + in them and then years later, they stop working, and you can't log in to fix your email address. Ask me how I know this.

Hah, this happened to me once. Turns out the email validation was occurring client-side though... so a quick edit later and the server still gladly accepted my '+'-enabled email address. :-)

Re: How to get gmail.com banned (2011)

#42

Post by aaronbasssett »

matt_kantor wrote: post #40
nkassis wrote: post #13

Earlier quoted context omitted.

Could use + in the first part of email such as: youremail+blahblah@example.com to create throwaways. most sites consider those to be different email address then youremail@example.com for account purposes but email service, who respect the rfc, will threat them as the same.

> Could use + in the first part of email [...] email service, who respect the rfc, will threat them as the same. I'm not aware of any RFC that says that mail sent to a+foo@example.com should go to the same mailbox as mail sent to a+bar@example.com (nor am I aware of any RFC that forbids this). I thought that GMail made up that feature and other vendors followed suit since users find it handy.

RFC 5233 - https://tools.ietf.org/html/rfc5233

Re: How to get gmail.com banned (2011)

#43

Post by graywh »

giancarlostoro wrote: post #38
paulmd wrote: post #19

Earlier quoted context omitted.

Many sites won't accept email addresses with + in them, because many devs have extremely wrongheaded ideas about validation. I used to have a first.m.last@university.edu address and that one was touch-and-go as well due to the fact that the mailbox had two .'s in it. I actually had to file a support request to get Amazon Student to accept it, even. Nobody from a university with that scheme ever registered before? For…

All this time I've been telling people my email has a . in it, I had no idea I could remove it and still login.

In the early days, you had to use the username as it was registered to log in.

Re: How to get gmail.com banned (2011)

#45

Post by driverdan »

GauntletWizard wrote: post #27
paulmd wrote: post #19

Earlier quoted context omitted.

Many sites won't accept email addresses with + in them, because many devs have extremely wrongheaded ideas about validation. I used to have a first.m.last@university.edu address and that one was touch-and-go as well due to the fact that the mailbox had two .'s in it. I actually had to file a support request to get Amazon Student to accept it, even. Nobody from a university with that scheme ever registered before? For…

My favorite is e-mails with three dots in them. Which is actually not a valid address - the RFC specifies that you must have a valid textual character between dots[1]. However, because of poor decisions by Japanese telcoms, a substantial chunk of their users have 'e-mails' associated with their mobile phones with three dots, breaking goddamn every sensible validation script. [1] https://tools.ietf.org/html/rfc2822#se…

> Which is actually not a valid address

That means validation was working correctly. The email addresses are invalid even if the server will accept email for them.

Re: How to get gmail.com banned (2011)

#46

Post by geofft »

tegansnyder wrote: post #21

I'm not sure his method would prevent a headless scraper like CasperJS or PhantomJS from doing the dirty work, but nice technique nonetheless.

At least at the time of writing, if you had enough foresight and engineering time to set something like that up, you had enough foresight and engineering time to not make your system treat email addresses as meaningful identities.

Re: How to get gmail.com banned (2011)

#47

Post by simi_ »

octo_t wrote: post #14
simi_ wrote: post #5

Here's a list of disposable email domains if you'd really like to block them: https://github.com/lavab/disposable I would go one step further and look for {spam_words} in "username+{text}@{googledomain}.com", where spam_words can be "junk", "spam", etc. This is like a very narrow edge case, but still might catch something. Again, if you're into that kind of thing; I'm quite skeptical that it brings any value.

until you have a the german guy, Joseph Unker, with junker89@gmail and your validation prevents them signing up :)

That's not at all what I meant. Gmail redirects emails to "youremail+whateveryouwanthere@gmail.com" to "youremail@gmail.com". Some people filter emails this way, henceforth my suggestion to check for this edge case.

http://gmailblog.blogspot.de/2008/03/2-hidden-ways-to-get-mo...

PS: The downvoters are downright silly on this website lately.

Re: How to get gmail.com banned (2011)

#48

Post by TimWolla »

aaronbasssett wrote: post #42
matt_kantor wrote: post #40

Earlier quoted context omitted.

> Could use + in the first part of email [...] email service, who respect the rfc, will threat them as the same. I'm not aware of any RFC that says that mail sent to a+foo@example.com should go to the same mailbox as mail sent to a+bar@example.com (nor am I aware of any RFC that forbids this). I thought that GMail made up that feature and other vendors followed suit since users find it handy.

RFC 5233 - https://tools.ietf.org/html/rfc5233

    > Subaddressing is the practice of augmenting the local-part of an
    > [RFC2822] address with some 'detail' information in order to give
    > some extra meaning to that address.  One common way of encoding
    > 'detail' information into the local-part is to add a 'separator
    > character sequence', such as "+", to form a boundary between the
                           ^^^^^^^^^^^
    > 'user' (original local-part) and 'detail' sub-parts of the address,
    > much like the "@" character forms the boundary between the local-part
    > and domain.
(Highlighting by me)

The RFC even gives an example using the hash:

    > o  A message addressed to "5551212#123@example.com" is delivered to
         the voice mailbox number "123" at phone number "5551212".

Re: How to get gmail.com banned (2011)

#49

Post by deckar01 »

dice wrote: post #10
zinxq wrote: post #4

Wow. Do my daily HN scan for the day and find an article you wrote ~4 years at #1. I hadn't read that in many years, and what fun to do a re-read. Thanks Internet - don't stop being you.

I was sad to see that the link to the domain generator was broken. The new one on the home page is a div that's generated server-side. I hope you don't mind that I wrote a quick one-liner to see if you're still detecting bots... @bobmail.info @zippymail.info @thisisnotmyrealemail.com @spamhereplease.com @safetymail.info @suremail.info @mailinator2.com @spamherelots.com @mailinator2.com @spamhereplease.com @spamherelo…

It looks like an exponential backoff except that it starts to favor the generic domains instead of refusing connections.

Re: How to get gmail.com banned (2011)

#50

Post by dragonwriter »

nkassis wrote: post #13
zer00eyz wrote: post #2

"Thousands of people use Mailinator everyday, so clearly, its a useful tool that many sites accept" How many of you would have an outright revolt on your hands from your QA/QE folks if you banned mailinator? I think everyplace I worked would experience this same issue if we did this.

Could use + in the first part of email such as: youremail+blahblah@example.com to create throwaways. most sites consider those to be different email address then youremail@example.com for account purposes but email service, who respect the rfc, will threat them as the same.

> Could use + in the first part of email such as: youremail+blahblah@example.com to create throwaways. most sites consider those to be different email address then youremail@example.com for account purposes but email service, who respect the rfc, will threat them as the same.

There is no RFC that requires this behavior. Subaddressing within the local part is recognized as a common practice (e.g., in RFC 5233), but nothing requires a system to support subaddressing, or requires a system that does to support a particular separator character or character sequence (e.g., "+") for subaddressing. Email systems are free to implement or not implement subaddressing, and to use any character sequence they want as the separator.

Post reply on HN