News for hackers. Stuff that matters.
Re:The Correct Way to Validate Email Addresses by cperciva on Wednesday September 07, 2016 @08:26PM (#12449237)
Worse than that: I've encountered a few web sites which accept email addresses with '+' characters... and then tell me that my email address has a ' ' character in it. Every time I see this I think "there's got to be a multiple-form-decoding vulnerability here"...
Re:The Correct Way to Validate Email Addresses by mook on Wednesday September 07, 2016 @09:22PM (#12449492)
I've got an account where they just plain stripped the + character. Since I happen to have used only alphanumeric charters after, I am now registered with an email address I can't actually receive mail on - it goes to somebody else's inbox.

Account synchronization was involved - IIRC the initial address confirmation message got thorough.

Re:The Correct Way to Validate Email Addresses by oddlyaromatic on Wednesday September 07, 2016 @10:15PM (#12449737)
I thought that though the + is valid, nothing after the + is used to differentiate the email address? I use local+Organization when I sign up for an email list so that I can easily filter, plus I can see if that email address gets shared around. So on places that reject the + I just use everything before it as the local part. Maybe I'm missing something. Edit: I guess not all email providers do it this way but here's a link to more info: https://www.cs.rutgers.edu/~watrous/plus-signs-in-email-addr...
Re:The Correct Way to Validate Email Addresses by zAy0LfpBZLC8mAC on Thursday September 08, 2016 @06:47AM (#12451796)
As far as email is concerned, "+" is just a character as any other. You might as well configure your mail server to ignore everything from the first "g" in the localpart when figuring out which mailbox to deliver to. Some mailservers happen to do this with a "+", if it happens to occur in a localpart, but that is just what they happen to be doing. There is nothing technically wrong with an email address like "[email protected]" or "[email protected]" or "[email protected]", and "[email protected]" is a different address than "[email protected]", unless the operator of example.net explicitly specifies otherwise.
Re:The Correct Way to Validate Email Addresses by Bartweiss on Thursday September 08, 2016 @10:41AM (#12453410)
So this is true on the email provider side, sometimes. Gmail (and a lot of others) rout foo+bar@gmail to foo@gmail. It's not required, but it's common.

The problem here, though, is that the email sender just stripped the + and sent the content to [email protected]. That's just a totally different account, chosen without warning.

Re:The Correct Way to Validate Email Addresses by gpvos on Thursday September 08, 2016 @02:58AM (#12450842)
Yeah, of course it will work, but then it's harder to filter their mail to an appropriate folder.
Re:The Correct Way to Validate Email Addresses by klmr on Thursday September 08, 2016 @07:05AM (#12451888)
Had this problem with Virgin Atlantic. Booked a ticket, never got it.
Re:The Correct Way to Validate Email Addresses by oladon on Wednesday September 07, 2016 @11:01PM (#12449973)
Southwest (Airlines) does this... or did a few years ago.
Re:The Correct Way to Validate Email Addresses by gpvos on Thursday September 08, 2016 @02:59AM (#12450845)
...and they probably send the confirmation mail to two addresses, both wrong.