Earlier quoted context omitted.
That works for GMail but not for a lot of other email providers.
Isn't that part of the email RFCs for 2 decades or so? Postfix certainly supports this for quite a while now. Edit: sendmail and qmail, too, apparently: https://www.cs.rutgers.edu/~watrous/plus-signs-in-email-addr...
Analysing the alleged Minneapolis police department “hack”
91–100 of 102 posts
Re: Analysing the alleged Minneapolis police department “hack”
#92Earlier quoted context omitted.
Read the wikipedia page, its pretty accurate. There have been arrests for 'Anonymous' hacks but it's not really a group, more so an idea.
You're totally right and I shouldn't have referred to them as one entity. Even so, I think that Twitter accounts "representing" Anonymous spreading misinformation really discredits the work other Anonymous members do.
such as?
Re: Analysing the alleged Minneapolis police department “hack”
#93Earlier quoted context omitted.
shopify has a similar thing, a two stage login where you sign in with your email then choose your account.
Microsoft has their notorious "is this account personal or issued by company it department" (or something like that) question when you login. Which is the reason it very often takes two tries and several minutes to get logged in as I never seem to guess the correct answer to that question...
However your organization may then do a deal with MS for Azure, or MSDN subscriptions, etc. And they’ll issue a login with the same email* address you@work.com — you now have two accounts tied to the same email, one which you created by yourself and one which your IT department created for you. There’s no way for you to change this second one. Typically authentication for the second one will happen via your org’s single sign on.
So the answer to “is this account personal or issued by your IT dept” really means — did you create the account yourself? Or was it provisioned for you by IT?
* Many orgs by default don’t use email to log in. Instead a “username” like jsmith is used instead. However while interfacing with Azure it seems to be a best practice to use email.
Re: Analysing the alleged Minneapolis police department “hack”
#94> it's extremely unusual to see the same email address with multiple different passwords in a legitimate data breach as most systems simply won't let an address register more than once I've actually built a system which did this years ago, over our initial protestations, and the reasoning went like this: Our client (this was a white label product) has lots of elderly couples as customers, these are our end users and…
nice.old.couple+alice@gmail.com nice.old.couple+bob@gmail.com
Re: Analysing the alleged Minneapolis police department “hack”
#95Earlier quoted context omitted.
Microsoft has their notorious "is this account personal or issued by company it department" (or something like that) question when you login. Which is the reason it very often takes two tries and several minutes to get logged in as I never seem to guess the correct answer to that question...
You can create a personal account with Azure or Microsoft more generically with your work email address, eg you@work.com. Because this was set up by you, you could conceivably change it to you@freemail.com. However your organization may then do a deal with MS for Azure, or MSDN subscriptions, etc. And they’ll issue a login with the same email* address you@work.com — you now have two accounts tied to the same email, o…
Re: Analysing the alleged Minneapolis police department “hack”
#96Earlier quoted context omitted.
nice.old.couple+alice@gmail.com nice.old.couple+bob@gmail.com
So like usernames, except very awkward and Google-only.
Easier to remember than a username because it's guaranteed to not be taken, so you can use the same email everywhere: email+name@provider.tld. Where as "alice" probably is taken.
Also should work with any email provider, it's part of the standard.
Re: Analysing the alleged Minneapolis police department “hack”
#97Earlier quoted context omitted.
So like usernames, except very awkward and Google-only.
Not really. I'm assuming the reason you'd share an email is so that you only need to be logged into one account in your mail client. Easier to remember than a username because it's guaranteed to not be taken, so you can use the same email everywhere: email+name@provider.tld. Where as "alice" probably is taken. Also should work with any email provider, it's part of the standard.
Re: Analysing the alleged Minneapolis police department “hack”
#98> it's extremely unusual to see the same email address with multiple different passwords in a legitimate data breach as most systems simply won't let an address register more than once I've actually built a system which did this years ago, over our initial protestations, and the reasoning went like this: Our client (this was a white label product) has lots of elderly couples as customers, these are our end users and…
nice.old.couple+alice@gmail.com nice.old.couple+bob@gmail.com
Re: Analysing the alleged Minneapolis police department “hack”
#99Earlier quoted context omitted.
nice.old.couple+alice@gmail.com nice.old.couple+bob@gmail.com
The number of websites that prevent me from doing this, because somebody wrote a shitty regex to invalidate most punctuation in an email address, is infuriatingly high.
Re: Analysing the alleged Minneapolis police department “hack”
#100Earlier quoted context omitted.
So like usernames, except very awkward and Google-only.
Not really. I'm assuming the reason you'd share an email is so that you only need to be logged into one account in your mail client. Easier to remember than a username because it's guaranteed to not be taken, so you can use the same email everywhere: email+name@provider.tld. Where as "alice" probably is taken. Also should work with any email provider, it's part of the standard.
If the intent is to allow two people to have independent accounts even while using an email they both control, offloading that to the email protocol seems broken to me. It's the exact same email address from the perspective of security. Anything coming after the plus sign should be ignored for the DB key, but kept around for sending emails, so it can still be used for filtering those emails (for convenience, not security). So they could sign up either as
alice
bob
or as alice
bob
but that difference should only ever matter for their email filtering, not for identifying them.