Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to get gmail.com banned (2011)

mailinator.blogspot.com

Post reply on HN
Print view View original

51–60 of 65 posts

Re: How to get gmail.com banned (2011)

#51

Post by brongondwana »

paulmd wrote: post #19
nkassis wrote: post #13

Earlier quoted context omitted.

Could use + in the first part of email such as: youremail+blahblah@example.com to create throwaways. most sites consider those to be different email address then youremail@example.com for account purposes but email service, who respect the rfc, will threat them as the same.

Many sites won't accept email addresses with + in them, because many devs have extremely wrongheaded ideas about validation. I used to have a first.m.last@university.edu address and that one was touch-and-go as well due to the fact that the mailbox had two .'s in it. I actually had to file a support request to get Amazon Student to accept it, even. Nobody from a university with that scheme ever registered before? For…

This is why we allow subdomain magic at FastMail, so that if you wanted to use myname+foo@fastmail.com you can use foo@myname.fastmail.com as well, and it works fine. Everyone accepts that form.

Re: How to get gmail.com banned (2011)

#52

Post by mangeletti »

adrianpike wrote: post #16
CWuestefeld wrote: post #15

A few years back we came into work one morning to find that some bot was scanning our site so hard that it seemed the lights nearly dimmed. Some detective work suggests that it was a service performed on behalf of a competitor, to get our price list (bear in mind that our catalog has a few hundred thousand products). We were really annoyed that rather than just ask us, they had launched what amounted to a DDOS attack…

I built a system called caltrops that did almost exactly that. As a given session's requests grew more and more suspicious, their data would skew from reality further and further. A real user on the line would notice immediately (and the more real-looking the user interactions, the more it would reduce suspicion), but competitors scraping our data would get pretty deliciously bunk data.

This is a most excellent idea!

Btw, did you actually return incorrect price data, or did you just insert random bytes, etc.?

Re: How to get gmail.com banned (2011)

#53

Post by thetruthseeker1 »

I love mailinator!

However tricking site scrappers may not work perfectly if the site scrappers maintained a list of websites in their "whitelist". Say if I am scrapping mailinator.com for domain names, if I see gmail.com or yahoo.com, I might just not put them in my database because they are in my whitelist.

Re: How to get gmail.com banned (2011)

#54

Post by paulmd »

GauntletWizard wrote: post #27
paulmd wrote: post #19

Earlier quoted context omitted.

Many sites won't accept email addresses with + in them, because many devs have extremely wrongheaded ideas about validation. I used to have a first.m.last@university.edu address and that one was touch-and-go as well due to the fact that the mailbox had two .'s in it. I actually had to file a support request to get Amazon Student to accept it, even. Nobody from a university with that scheme ever registered before? For…

My favorite is e-mails with three dots in them. Which is actually not a valid address - the RFC specifies that you must have a valid textual character between dots[1]. However, because of poor decisions by Japanese telcoms, a substantial chunk of their users have 'e-mails' associated with their mobile phones with three dots, breaking goddamn every sensible validation script. [1] https://tools.ietf.org/html/rfc2822#se…

So wait, what now? So you can have an email address like first.last@isp..co.jp? Can you give me a generic example?

Yeah, I'm with the other guy, regardless of whether or not it's a good idea to do validation (it's not), that's not an address that should pass validation because it's not a valid domain or hostname.

I could see it being less of a big deal in the mailbox portion given that it's now kinda kosher to ignore dots there.

Re: How to get gmail.com banned (2011)

#55

Post by sk5t »

ori_b wrote: post #31
GauntletWizard wrote: post #27

Earlier quoted context omitted.

My favorite is e-mails with three dots in them. Which is actually not a valid address - the RFC specifies that you must have a valid textual character between dots[1]. However, because of poor decisions by Japanese telcoms, a substantial chunk of their users have 'e-mails' associated with their mobile phones with three dots, breaking goddamn every sensible validation script. [1] https://tools.ietf.org/html/rfc2822#se…

There's only one sensible validation script: "Send an email with a confirm link".

Taking action with side-effects on entirely unvalidated user input is usually a pretty bad idea.

Re: How to get gmail.com banned (2011)

#56

Post by belovedeagle »

GauntletWizard wrote: post #35
ori_b wrote: post #31

Earlier quoted context omitted.

There's only one sensible validation script: "Send an email with a confirm link".

Sadly, if you're sending e-mail sanely, your mail provider likely validates recipients, and will be annoyed at you if you send them recipients they think are bogus.

The relevant rfc (on mobile; don't remember which) specifically states that intermediate servers must not validate mailboxes (local parts). And honestly the domain should be "validated" by the server doing an mx lookup; let dns handle it.

Re: How to get gmail.com banned (2011)

#59

Post by PebblesHD »

aidenn0 wrote: post #23
paulmd wrote: post #19

Earlier quoted context omitted.

Many sites won't accept email addresses with + in them, because many devs have extremely wrongheaded ideas about validation. I used to have a first.m.last@university.edu address and that one was touch-and-go as well due to the fact that the mailbox had two .'s in it. I actually had to file a support request to get Amazon Student to accept it, even. Nobody from a university with that scheme ever registered before? For…

I had a first.m.last@university.edu (though I have a really common name so it was actually first.m.last.3@university.edu), but fortunately they also gave us 8 character usernames (which were also our login to our shared hosting on the Sun E6500 machine), but I never used the long form since it was rejected nearly everywhere.

My university address at the moment causes similar issues, it follows the first.m.last@group.uni.edu.au form which throws off lots of input validators.
Post reply on HN