Hacker News Reader

Comment by michaelteter | Hacker News Reader

With some email services including Gmail and Protonmail you can add +whatever to your username part of the email address to get the same result. My name+flightaware@gmail.com for example…

And many mail hosting services let you assign a catch-all, which allows you to simply use anything@mydomain.com to get the same result.

View on HN

The former would seem ineffective, surely anyone buying such a dataset would just remove the "+___" part in emails that have them?

Why would they bother?

To limit evidence of culpability in the event of a data leak exactly like the one we’re discussing.

Why would the hacker care about that?

Because they assume you've set name+spam@gmail.com to be filtered directly to spam, and they can easily evade those filters by removing the ±spam part.

Big companies do this. I have signed up for things using a +filter email address, only to receive the emails from that company that is signed up to get at my plane address, without the +filter part.

Because the overwhelming number of people with “+” in their email address are unlikely to click on spam.

Enough sites don't accept + in the address.

Even if you can enter it, various backends in the same company might not handle it correctly and you enter up with an half-working account that their customer support (if they even have that...) cannot solve. Been there, tried that...

Personally I have - as the separator (not on gmail or similar). If you have to give you email on the phone it can cause lengthy discussions why their company name appears in my email address..

Is that still the case though? I use plus addressing everywhere and works fine for me so far.

I haven't had issues with it in many years.

Don't know. Last time I experienced problems was when entering a family members gmail address with a plus sign to share my newspaper subscription. They could not use it and I could not remove it... That was about 5 years ago. Have been burned too often, don't try it anymore.

what's important in "anything", if you can, is name, company, and some pseudorandom chars. Because company@example.com or name+company@example.com is easy enough to guess, but pseudorand_name_company_kroj38@example.com isn't plausibly going to get guessed at.

Reply on news.ycombinator.com