Re:Complexities of e-mail validation logic
by scubbo on Monday May 24, 2021 @01:09PM
(#27266949)
I once had a site _silently strip_ the + from signup email. So when I submitted `[email protected]` as my email address, they started sending mail to `[email protected]`. Madness.
[ Parent
| on HN ]
This is common; spammers know the semantics of '+' for gmail and will strip it. You need to assume that it will happen.
GP said the site stripped the “+” only, essentially sending his email to another address entirely. Spammers strip the “+” and whatever follows it, so the spam ends up at the same address.
If spammers are converting from `[email protected]` to `[email protected]`, they are welcome to spam it as much as they want - it won't get to me.
EDIT: moreover, a service is perfectly within their rights to _internally_ store my email as `[email protected]` if they want - but they should still accept `[email protected]` as the identifier used to login with.