Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft adding support for custom '+' email addresses in Office 365

zdnet.com

Post reply on HN
Print view View original

1–10 of 129 posts

Re: Microsoft adding support for custom '+' email addresses in Office 365

#2

Post by forgotmypw17 »

I understand the appeal of this feature for sorting, but it seems ineffective for things like "figure out who sold my email to the spammers" because everyone knows about it and it's elementary to just trim off everything after the plus sign.

Unless you do some kind of verification and filter email sent to addresses without a valid suffix?

Re: Microsoft adding support for custom '+' email addresses in Office 365

#3

Post by Traubenfuchs »

forgotmypw17 wrote: post #2

I understand the appeal of this feature for sorting, but it seems ineffective for things like "figure out who sold my email to the spammers" because everyone knows about it and it's elementary to just trim off everything after the plus sign. Unless you do some kind of verification and filter email sent to addresses without a valid suffix?

If bad actors cut off the +, fight back by not using your bare email at all: Provide everyone with a + address, ignore all emails that come without.

Re: Microsoft adding support for custom '+' email addresses in Office 365

#4

Post by jeremiahlee »

Traubenfuchs wrote: post #3
forgotmypw17 wrote: post #2

I understand the appeal of this feature for sorting, but it seems ineffective for things like "figure out who sold my email to the spammers" because everyone knows about it and it's elementary to just trim off everything after the plus sign. Unless you do some kind of verification and filter email sent to addresses without a valid suffix?

If bad actors cut off the +, fight back by not using your bare email at all: Provide everyone with a + address, ignore all emails that come without.

I would agree with this technique, but it’s not possible due to the high number of services that don’t permit “+” in the email address or break because they don’t URI encode it. I have several services I will never be able to unsubscribe from because of the latter—and yes, I tried manually URI encoding it and changing the form fields with dev tools.

Re: Microsoft adding support for custom '+' email addresses in Office 365

#6

Post by iggldiggl »

Traubenfuchs wrote: post #3
forgotmypw17 wrote: post #2

I understand the appeal of this feature for sorting, but it seems ineffective for things like "figure out who sold my email to the spammers" because everyone knows about it and it's elementary to just trim off everything after the plus sign. Unless you do some kind of verification and filter email sent to addresses without a valid suffix?

If bad actors cut off the +, fight back by not using your bare email at all: Provide everyone with a + address, ignore all emails that come without.

Curiously enough, so far I've only ever observed the reverse happening - spammers somehow ending up stripping off the common prefix and leaving the individual suffix intact.

(Though on the other hand thankfully I'm still not getting much spam anyway and it's only a few addresses that were affected, so I only have a limited amount of data to go by.)

Re: Microsoft adding support for custom '+' email addresses in Office 365

#8

Post by usrusr »

iggldiggl wrote: post #6
Traubenfuchs wrote: post #3

Earlier quoted context omitted.

If bad actors cut off the +, fight back by not using your bare email at all: Provide everyone with a + address, ignore all emails that come without.

Curiously enough, so far I've only ever observed the reverse happening - spammers somehow ending up stripping off the common prefix and leaving the individual suffix intact. (Though on the other hand thankfully I'm still not getting much spam anyway and it's only a few addresses that were affected, so I only have a limited amount of data to go by.)

Not really surprising: in the eyes of a naive regex for extracting email addresses from a string, a+b@c.d contains a nicely email-looking substring b@c.d but a@c.d isn't contained at all. Spammer address supply chains aren't usually characterized by the highest levels of sophistication.

Re: Microsoft adding support for custom '+' email addresses in Office 365

#9

Post by scrollaway »

jeremiahlee wrote: post #4
Traubenfuchs wrote: post #3

Earlier quoted context omitted.

If bad actors cut off the +, fight back by not using your bare email at all: Provide everyone with a + address, ignore all emails that come without.

I would agree with this technique, but it’s not possible due to the high number of services that don’t permit “+” in the email address or break because they don’t URI encode it. I have several services I will never be able to unsubscribe from because of the latter—and yes, I tried manually URI encoding it and changing the form fields with dev tools.

Such services are likely breaking the law.

Edit: Downvote me all you want, they're still breaking the law… In the US there's the CAN-SPAM act (https://www.ftc.gov/tips-advice/business-center/guidance/can...) and nearly every other country has similar laws. Most of them require one-click unsubscribes to work.

It's still failure to comply even if it's due to negligence/ignorance/incompetence.

Post reply on HN