Let them paste passwords

Re:Let them paste passwords by NoGravitas on Thursday May 18, 2017 @01:44PM (#14369350)

I wouldn't say "a few other email providers that have followed suit". As far as I know, that's always been a feature of Postfix, and common with Sendmail before that. And qmail offered "-" for the same purpose (as well as providing a facility for filtering/redirecting mail based on -extensions).

[ Parent | on HN ]

Re:Let them paste passwords by e12e on Thursday May 18, 2017 @02:13PM (#14369622)

The standard (as in most common setup) for djb's qmail, was to accept/forward mail for <prefix>@user.example.com to [email protected], as in: [email protected] rather than [email protected].

While I believe the + was common for postfix, exim and sendmail?

There even was a spam-fighting scheme that used this - it took a key, and optional date, and a sender address - and generated a unique address you could give out, that was only valid for a certain time, for a certain set of senders.

If the system received a mail with a from address that didn't match the cryptologically signed to-address ([email protected]) - the mail was held back, and the system generated a reply, with a signed reply-to address. A sort of manual grey-listing.

[ Parent | on HN ]

Re:Let them paste passwords by eridius on Thursday May 18, 2017 @01:51PM (#14369414)

The point is that foo+bar is a convention that many providers follow and not an actual rule of email, and therefore blocking that doesn't make sense because you'll block legitimate addresses too.

Similarly, mail providers can come up with all sorts of different conventions if they want. For example, when setting up a new domain in FastMail, it offers the ability to accept [email protected] and turn that into [email protected], and it offers [email protected] which it will deliver to [email protected]. So here we already have two new conventions that sites can't possibly detect as alternatives to the normal [email protected].

[ Parent | on HN ]