News for hackers. Stuff that matters.
Re:Millions of email addresses leaking to advertising and an... by dhimes on Friday May 01, 2020 @07:12AM (#23040926)
I thought the bad guys knew to strip the markers by now.
Re:Millions of email addresses leaking to advertising and an... by zenexer on Friday May 01, 2020 @08:50AM (#23041461)
That + symbol is part of a pseudo-regex; it’s not part of the email address. You’re probably thinking of the email+whatever@whatever syntax, which isn’t what’s being described here. There’s nothing to strip in this case.
Re:Millions of email addresses leaking to advertising and an... by dhimes on Friday May 01, 2020 @01:23PM (#23044364)
Whoops- you are correct. Pre-coffee me mis-read that. Thanks for the heads-up.
Re:Millions of email addresses leaking to advertising and an... by swiley on Friday May 01, 2020 @07:28AM (#23041001)
According to the RFC ‘+’ is a valid character and tagged addresses (which aren’t mentioned) represent unique users (so removing the marker could result in the email not being delivered at all.)

IME: I’ve never had anyone remove it (although some don’t accept it and others will have bugs that result in an unusable account if you register with it.) I used one with the company I most recently interviewed at (they used a third party service for the HR site and I’ve had trouble with sites like that selling my email address which is just so enraging honestly.) Every. Single. Time. I logged in to fill out a form after getting hired I had to call HR and have them reset my account because of some weird bug.

Re:Millions of email addresses leaking to advertising and an... by petercooper on Friday May 01, 2020 @10:39AM (#23042406)
According to the RFC ‘+’ is a valid character and tagged addresses (which aren’t mentioned) represent unique users (so removing the marker could result in the email not being delivered at all.)

Though similarly, email usernames ('local part') are case sensitive but I've never encountered a mail server where this was the case. I imagine if a nefarious party stripped the markers, they'd lose the tiniest percentage of their audience that way.

(Aside: Your own approach to using + is quite clever as it's the total opposite to most users, so you'll see who pulls this trick ;-))

Re:Millions of email addresses leaking to advertising and an... by steerablesafe on Friday May 01, 2020 @07:21AM (#23040973)
The trick is to forward emails with no marker to spam. Sure they can strip markers but I assume they don't replace markers to match my "canonical" email address.
Re:Millions of email addresses leaking to advertising and an... by stiray on Friday May 01, 2020 @07:21AM (#23040975)
You will have to elaborate, I don't understand. Marker is here just to handle mail on server side and I can easly upgrade it to hash of hash + salt and handle it programatically on server but there was never any need for it. And anyway I couldn't care less, without it mail is invalid, still 0 spam. And I am doing it for last 10 years so it is battle proven.
Re:Millions of email addresses leaking to advertising and an... by sealjam on Friday May 01, 2020 @08:43AM (#23041418)
I think the responder misread your message and assumed you were adding a suffix like \+\w+ to the end of your email addresses like [email protected] -> [email protected]

Several email providers treat a + symbol as the end of the first part of the address and ignore everything between it and the @.

I think the responder’s point was that analytics providers just ignore things after a + too

Re:Millions of email addresses leaking to advertising and an... by dhimes on Friday May 01, 2020 @01:24PM (#23044372)
Yes, that's exactly what happened. Oops.