Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I think you overestimate the desire to screen email addresses and remove any "tags" that are on them. Most spammers and even companies don't even care WHAT the email is, as long as it doesn't bounce.


This is an insecure solution that doesn't scale, and only works because nobody uses it.

I don't need to lock my door either, but that kind of security doesn't scale. I either use mailinator for throwaway email signups, or I have a spam gmail account.

But I'm not going to give out my main account+marker if I expect to want to be able to undo sharing my email in the future at some point that I try to follow an unsubscribe link and it doesn't work, or because my email might get sold: that's just downright silly. You think the kind of people that would sell email lists wouldn't run a regex to strip +spam markers from gmail accounts?

You literally have to apply a one-line regex to do that. It's security by obscurity. Anyone working at google should understand that.


+whatever is a valid email address, and just because Gmail automatically creates a "tagable" feature with it, doesn't mean Joe Blow can't have joe+blow@example.com be a REAL address that if you strip +blow from, it'll still be delivered to him.


I don't know why you said that. Gmail addresses can't have +'s in them

https://support.google.com/mail/answer/12096?hl=en

everything I wrote applies only and specifically to gmail. it would be trivial to strip the +'s from every gmail address to get right into the person's main inbox.

If I don't trust a person to stop spamming me or sell my email address then I'm not going to trust a person not to do that.


> I don't know why you said that. Gmail addresses can't have +'s in them

I was saying that regarding to automatically stripping out +string from the email to thwart this. Gmail uses them as a special character, but it is a valid email character, along with all these http://stackoverflow.com/a/2049510


All right, but I was referring to automatically stripping out +string from emails at gmail's domain (which loads of people use, including me.) So we're talking past each other and it's not a valid reason why gmail shouldn't implement this. but thanks.


Ah, I see. Yeah on @gmail I see what you're talking about. I was thinking a regex on just the username of the email to remove +word




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: