logoalt Hacker News

pestslast Friday at 10:31 PM1 replyview on HN

Some sites (hulu maybe? iirc) strip off the + and treat it as a bare email, with dedupe checks and all that.

Spammers won't respect the + either, they will clean their list of any +tags before sending.

The best I've actually come across is to abuse gmails period policy. I haven't seen sites dedupe this or perform any other checks or manipulation.

If you have enough letters in your alias you can treat the possible period locations as binary. For example, pests@ would have 4 edible spots, so I could make 16 different dot addresses: pests@, pest.s@, pes.ts@, pes.t.s@, pe.sts@, pe.st.s@, [...], p.e.s.t.s@

Then you can just remember/record the decimal ID you used per site.


Replies

epistasislast Friday at 10:45 PM

> Spammers won't respect the + either, they will clean their list of any +tags before sending.

That's the entire point, if you get an email from the site but it doesn't include your +servicename tag then you immediately can immediately tell it's a phishing attempt or spam. If the tag is there it's not a 100% guarantee that it's legit, but absence of the tag is a big red flag.

show 1 reply