News for hackers. Stuff that matters.

A comment on Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'. Parent comment

Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by IAmEveryone on Monday December 16, 2019 @09:44PM (#21810036)
...and only one in 50,000 e-mail addresses contain the string "rq5", therefore we strip that string from addresses...

A false postive in these identity checks is likely to be less destructive than a false negative. But I still don't get the point of making up all sorts of rules not in the standard. I have seen both + as well as meaningful dots in e-mail adresses in the wild.

[ Parent | on HN ]
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by _jal on Monday December 16, 2019 @10:11PM (#21810168)
+ and . have is legal in email addresses since it was standardized.

Google was the first installation I know of to silently swallow periods. Plus-addressing was well-known back in the day, but as far as I know GUI mailers more or less killed the practice by not offering support for it, and web sites written by people too smart to know how to validate email addresses ensured you can't even use them properly anymore.

Ref: http://www.faqs.org/rfcs/rfc822.html, pages 8/9.

[ Parent | on HN ]