Comment on For security reasons

• neatchee@lemmy.world ⁨1⁩ ⁨month⁩ ago

  Yeah I agree that one seems silly on the surface but for their specific situation I understand why: services like Gmail allow using a + to create faux-labels. So for example foo@gmail, foo+bar@gmail, and foo+baz@gmail all get delivered to the same account. For change.org that’s a problem because it allows a single email account to fill out the form many times.

  Ideally, they would simply truncate everything after and including those symbols but it’s possible other services have different rules (maybe yahoo let’s you pretend faux-tags instead of appending them, or something like that) so simply blocking their use altogether could be the more robust solution

  source

  • hemko@lemmy.dbzer0.com ⁨1⁩ ⁨month⁩ ago

    Eh, honestly I think blocking plus addressing as a workaround to block people from using multiple identities on the site is very weak argument and ignores completely the reason plus addeesses are being used in the first place, tagging.

    And the addition of “-” just tells they don’t really know what they’re doing, considering it’s not only valid but also very common symbol in email addresses

    source

    • neatchee@lemmy.world ⁨1⁩ ⁨month⁩ ago

      I don’t think the reason they’re being used is relevant to their problem though. “Think like an attacker” wins the day here: as an attacker, I don’t care what it’s meant for, only how I can use it to my advantage. If it’s something they observed as a problem, I understand why they would want to stop it.

      As for “-”, yeah, I don’t have a particularly good explanation for that one except the assumption that it’s something similar to + addressing on a different service.

      source

      • bloor@feddit.de ⁨1⁩ ⁨month⁩ ago

        “-” is the default delimiter in qmail. I administer a system, where both + and - are valid recipient delimiters for historic reasons and we can’t really get rid of it.

        Believe me, it has caused all kinds of problems, where we have to go deep into the finer differences between aliases and virtual aliases and transport maps in postfix to route mails correctly. Especially since we have a lot of Mailinglists with - as a valid character in them.

        So to summarize: the assumption by changeorg is valid, however the execution seems rather flawed.

        source

        • -> View More Comments
  • scrion@lemmy.world ⁨1⁩ ⁨month⁩ ago

    The local parts of email addresses are standardized, and there is an RFC handling subadressing as well, see RFC 5233 - it’s not like Gmail invented this behavior.

    Also, RFC 5321 clearly states (2.3.11) that the local part of an email must only be interpreted by the receiving server, so that part should not be parsed, modified or mangled in any form - the assumptions poor web forms or validation libraries make these days are incredibly annoying and simply not compliant.

    So no, non of your suggestions are good, let alone ideal. Ideally, people would simply implement the specs and stop making lazy and false assumptions. In the case you cited, it turns out email validation is simply not the proper tool to limit how often the form can be submitted. Similar websites use e. g. text messages.

    source

    • neatchee@lemmy.world ⁨1⁩ ⁨month⁩ ago

      Requiring SMS validation is a massive barrier to entry and not a viable option for a service like Change.org that relies on a certain level of participation.

      source

      • scrion@lemmy.world ⁨1⁩ ⁨month⁩ ago

        I’m aware of that, but let’s be honest here: social and political changes are not introduced, let alone solved, by technology.

        You said it perfectly: this is about business needs. I’d like to argue to make the barrier for entry even higher (tie it to a form of citizen identity) and mandate the petition must be reviewed / acted upon once it has become significant - frameworks like this do exist already in several countries.

        Everyone has multiple email addresses today, does that not fundamentally erode the validity of change.org as a platform for direct democracy then? I do believe this is the case, so I’d love if another website would at least stop violating already existing standards and force their erroneous interpretation of how email addresses work down our throats.

        source

        • -> View More Comments
  • Racle@sopuli.xyz ⁨1⁩ ⁨month⁩ ago

    Gmail allow using a + to create faux-labels

    I wonder how they handle gmail addresses with dots as you can put dot in anywhere and it still will redirect to your email.

    I’ve setup (for few services which don’t allow + sign) emails like foobar@gmail.com, foo.bar@gmail.com, fo.o.bar@gmail.com and they all come to my inbox.

    source

    • 0x0@programming.dev ⁨1⁩ ⁨month⁩ ago

      IIRC Gmail interprets foo.bar, f.o.o.b.a.r and foobar as the same account (the latter).

      source

      • sukhmel@programming.dev ⁨1⁩ ⁨month⁩ ago

        At some point they didn’t, so I heard there are now a couple of accounts that only differ in dot and it’s not yet resolved by Google ¯\_(ツ)_/¯

        source
      • Racle@sopuli.xyz ⁨1⁩ ⁨month⁩ ago

        Yep, that what I was trying to say 😄 Been using that feature for years.

        source
    • neatchee@lemmy.world ⁨1⁩ ⁨month⁩ ago

      I imagine because it can’t be used to add additional junk characters to the address, they probably just strip them out before doing their string comparison

      source

      • Racle@sopuli.xyz ⁨1⁩ ⁨month⁩ ago

        If they know this case. In other email services dots are usually not a junk characters.

        source

        • -> View More Comments
• eee@lemm.ee ⁨1⁩ ⁨month⁩ ago

  that’s to stop people from spamming signatures with user+1@gmail, user+2@gmail, user+3@gmail, etc.

  source

  • hemko@lemmy.dbzer0.com ⁨1⁩ ⁨month⁩ ago

    You can still spam with user1@domain.tld, user2@domain.tld etc and it takes basically no extra effort

    source

    • alphafalcon@feddit.de ⁨1⁩ ⁨month⁩ ago

      IF you already have an email domain you control.

      Calling “acquiring and setting up an email domain and configuring the mail server for wildcards” “basically no extra effort” is a bit disingenuous compared to “solve a captcha for a Gmail account”

      source
    • eee@lemm.ee ⁨1⁩ ⁨month⁩ ago

      Spamming user+1@gmail, user+2@gmail takes absolutely no technical knowledge whatsoever - anyone can do it with 1 gmail account.

      Spamming user1@domain, user2@domain etc requires 1 of two things:

      1. you can sign up for multiple email accounts using a third party service. You’re going to run into trouble with Gmail or other big providers if you start creating accounts en masse.

      2. you create your own email server. this requires someone with selfhosting knowledge and some basic coding (or rather server config) experience.

      source
    • Localhorst86@feddit.de ⁨1⁩ ⁨month⁩ ago

      it takes basically no extra effort

      I’d assume one needs to verify the email by clicking a link, so to spam user1@domain.tld, user2@domain.tld would mean you need access to those inboxes. That means you need to go through the effort to actually create those emailadresses on whatever freemail service you chose, or you need to host the emailserver yourself and have all mails run into a catchall inbox.
      Hosting your own emailserver is definately a lot more effort, even for a lot of tech-savvy people, paying for a hosted email service using your own domain is easier, but also seems like not a good investment just to spam a petition website.

      The foo+bar@gmail.com functionality, however, is pretty well known tool - even by non-tech savvy people. Even some people I know that I consider basically tech-illiterate have known this for years have told me they found out about it and asked me if I was aware of this functionality.

      The first one I mentioned preparation, setting up email accounts or an email server, the second one is basically already set up for most email users and ready to go, the latter is therefore definately a lot less effort to pull off.

      source