Hello all,

I was just going thru "krebs on security" and found an article about "The
Security Pros and Cons of Using Email Aliases" (
https://krebsonsecurity.com/2022/08/the-security-pros-and-cons-of-using-email-aliases/#more-60800 )
..

I remember having read something similar somewhere, and never understood it.
Assuming that I use the email alias myname+somecompany@myhost.com what stops
anyone / a bad actor from removing the "+somecompany" part (to get to the
main email address) ?

Regards,
Rudy Wieser

On 8/23/2022 10:59 AM, R.Wieser wrote:
> Hello all,
>
> I was just going thru "krebs on security" and found an article about "The
> Security Pros and Cons of Using Email Aliases" (
> https://krebsonsecurity.com/2022/08/the-security-pros-and-cons-of-using-email-aliases/#more-60800 )
> .
>
> I remember having read something similar somewhere, and never understood it.
> Assuming that I use the email alias myname+somecompany@myhost.com what stops
> anyone / a bad actor from removing the "+somecompany" part (to get to the
> main email address) ?
>
> Regards,
> Rudy Wieser
>
>

That could indeed be a problem unless there is no such E-mail address as
<myname@myhost.com>. A good alias would have the local-part (the part
to the left of the @) avoid anything representing a real address. Thus,
if there really is such an E-mail address as <myname@myhost.com> but not
such as <hisname@myhost.com>, then a good alias would be
<hisname+somecompany@myhost.com>.

I never use an alias. The ISP that hosts my E-mail has a tool on its
mail server that allows me to create new addresses. For an existing
address, that tool allows me to disable it without deleting it or to
block incoming E-mail to it without blocking outgoing E-mail from it.

--
David E. Ross
<http://www.rossde.com/>

Beyond Meat and other such vegetarian meat substitutes
represent the ultimate in ultra-processed foods. Real
meat is natural. Beyond Meat is definitely not.

David,

> if there really is such an E-mail address as <myname@myhost.com> but
> not such as <hisname@myhost.com>, then a good alias would be
> <hisname+somecompany@myhost.com>.

Thats what I was thinking of too, but than isn't the alias not simply
"hisname+somecompany" in its whole ? I mean neither "hisname" nor
"somecompany" can be used on its own (as the "username").

Personally I have a few aliases made up outof an alphanumeric (random)
string, a dot and than some readable part. I do not consider that
connecting dot to be special either. I could just leave it out.

IOW, I don't understand the fuzz about that "+" character.

Regards,
Rudy Wieser

David (others),

After some pondering I think the below is how such an "+" email address is
used :

1) The email adress hisname+somecompany@myhost.com is used and send to the
domain.

2) The domain applies the filter hisname+*@myhost.com and finds a match,
resulting in the message being put into the myname@myhost.com email box.

3) Depending on the user his email reader applies its own filter(s) so that
hisname+somecompany@myhost.com and hisname+someothercompany@myhost.com get
sorted into their own, local folders.

In other words, the hisname+*@myhost.com addres becomes the users equivalent
of a domains "catch all" address. With the same problems.

Regards,
Rudy Wieser

"R.Wieser" <address@not.available> wrote in message
news:te4fsi$1g06$1@gioia.aioe.org...

| In other words, the hisname+*@myhost.com addres becomes the users
equivalent
| of a domains "catch all" address. With the same problems.
|

It reads to me as just ninny advice for people who
don't deal with details. So they have a formula.
rudy+etsy#gmail. rudy+amazon@gmail. If the email
account doesn't even need to work then no one's
going to be hacking it. And no humans will see it, anyway.

But what's with +? He seems to be saying that POP3
or IMAP won't count what comes after, so rudy+amazon@gmail
will automatically go to rudy@gmail? Since when? Is
that an official SMTP rule? Or is it just gmail? And as you
say, if that's true then it's not really a different address.
And if you're going to want to receive that email anyway,
why do it? If I get email from amazon I'll just make a rule
to delete it based on sender.

Mayayana,

> | In other words, the hisname+*@myhost.com addres becomes the
> | users equivalent of a domains "catch all" address. With
> |the same problems.
>
> It reads to me as just ninny advice for people who
> don't deal with details.

Who's advice ? In the above you've quoted me, but somehow I think you're
talking about/to David.

> But what's with +? He seems to be saying that POP3
> or IMAP won't count what comes after, so rudy+amazon@gmail
> will automatically go to rudy@gmail?

That was what I had problems with too, and asked about. If so it would be
downright stupid.

But as I currenly only have some "best guesses" about that I can't answer
you with any kind of authority there I'm afraid.

> Since when? Is that an official SMTP rule?

I have no idea. I can't even remember having ever come across anything
talking about it.

> And if you're going to want to receive that email anyway,
> why do it?

The problem is not receiving a message from some company, but to keep all
others (spammers) out.

IOW, you do not /just/ put the companies name in there - it would be too
easy to guess for someone else - but at least add a "magic number" to it, so
you can recognise its from the company you gave the email address to.

Regards,
Rudy Wieser

On 8/23/2022 11:18 PM, R.Wieser wrote:
> David (others),
>
> After some pondering I think the below is how such an "+" email address is
> used :
>
> 1) The email adress hisname+somecompany@myhost.com is used and send to the
> domain.
>
> 2) The domain applies the filter hisname+*@myhost.com and finds a match,
> resulting in the message being put into the myname@myhost.com email box.
>
> 3) Depending on the user his email reader applies its own filter(s) so that
> hisname+somecompany@myhost.com and hisname+someothercompany@myhost.com get
> sorted into their own, local folders.
>
> In other words, the hisname+*@myhost.com addres becomes the users equivalent
> of a domains "catch all" address. With the same problems.
>
> Regards,
> Rudy Wieser

Neither RFC 5322 nor RFC 6854 provide what you decribe. Therefore, what
you describe is not conventional; and E-mail servers do not necessarily
do that.

Instead, it is possible that some servers allow filters to do what you
describe. I believe that cPanel (used by my E-mail host) would allow me
to setup such a filter on the host's server. However, that filter would
apply only to my domain and not to the entire server.

--
David E. Ross
<http://www.rossde.com/>

Beyond Meat and other such vegetarian meat substitutes
represent the ultimate in ultra-processed foods. Real
meat is natural. Beyond Meat is definitely not.

On 8/24/2022 11:05 AM, David E. Ross wrote:
> On 8/23/2022 11:18 PM, R.Wieser wrote:
>> David (others),
>>
>> After some pondering I think the below is how such an "+" email address is
>> used :
>>
>> 1) The email adress hisname+somecompany@myhost.com is used and send to the
>> domain.
>>
>> 2) The domain applies the filter hisname+*@myhost.com and finds a match,
>> resulting in the message being put into the myname@myhost.com email box.
>>
>> 3) Depending on the user his email reader applies its own filter(s) so that
>> hisname+somecompany@myhost.com and hisname+someothercompany@myhost.com get
>> sorted into their own, local folders.
>>
>> In other words, the hisname+*@myhost.com addres becomes the users equivalent
>> of a domains "catch all" address. With the same problems.
>>
>> Regards,
>> Rudy Wieser
>
> Neither RFC 5322 nor RFC 6854 provide what you decribe. Therefore, what
> you describe is not conventional; and E-mail servers do not necessarily
> do that.
>
> Instead, it is possible that some servers allow filters to do what you
> describe. I believe that cPanel (used by my E-mail host) would allow me
> to setup such a filter on the host's server. However, that filter would
> apply only to my domain and not to the entire server.
>

Gmail Plus Address

So what is a Gmail Plus address? Say you have an email address like
billgates@gmail.com. If you append a “plus” sign to your email username,
Gmail will ignore anything written between the + and @ sign in the email
address and still deliver the message to the same mailbox.

R.Wieser <address@not.available> wrote:
> Hello all,
>
> I was just going thru "krebs on security" and found an article about "The
> Security Pros and Cons of Using Email Aliases" (
> https://krebsonsecurity.com/2022/08/the-security-pros-and-cons-of-using-email-aliases/#more-60800 )
> .
>
> I remember having read something similar somewhere, and never understood it.
> Assuming that I use the email alias myname+somecompany@myhost.com what stops
> anyone / a bad actor from removing the "+somecompany" part (to get to the
> main email address) ?

Nothing. Plus addressing is not meant to protect the main email
address. It's meant to be used for filtering incoming mail. They are not
email aliases, but alternatives for email aliases.

For example, several Usenet posters use plus-addresses like
<username>+usenet@<MSP> (where <MSP> is their Mail Service Provider) in
their 'From:' lines, to easily filter emailed responses to their posts.

I did a simple search on "what does a plus in an email address mean"
and think that this document explains it quite well:

<https://www.fastmail.help/hc/en-us/articles/360060591053-Plus-addressing-and-subdomain-addressing>

David,

> Neither RFC 5322 nor RFC 6854 provide what you decribe.

Worse, I can't google/DDG/brave any info about it either. :-\

> Therefore, what you describe is not conventional; and E-mail servers do
> not necessarily do that.
>
> Instead, it is possible that some servers allow filters to do what
> you describe.

Agreed to both.

Regards,
Rudy Wieser

Zaidy,

> Gmail will ignore anything written between the + and @ sign in the email
> address and still deliver the message to the same mailbox.

Assuming the "to:" field than still contains the origional "to" that would
leave it upto the users email client to filter out the messages that he's
interrested in (having the correct phrase between the "+" and "@") and
discard the rest. Yep, that could work.

Just never use it on a postbox on which the base email address (without a
"+" phrase) is also used.

Regards,
Rudy Wieser

Frank,

> Plus addressing is not meant to protect the main email address.
> It's meant to be used for filtering incoming mail. They are not
> email aliases, but alternatives for email aliases.

Thats the problem : The idea is to create an identifiable email address. But
a bad player could just cut the "+" phrase outof it and start to spam the
resulting email address. No way to figure out who the company was which
"+" phrase was removed.

IOW, it /sounds/ like a good thing, but, in the situation you describe, the
user has to be rather carefull with it. Probably not use the base email
address for anything, and throw anything addressed to it away.

"For example, suppose you gave someone the address
username+hiking@domain.tld. Any messages sent to this address will be
delivered to username@domain.tld,"

Thats the whole problem in a nutshell. Someone over at fastmail did not
think about the nuissance implications of that. :-(

Regards,
Rudy Wieser

"R.Wieser" <address@not.available> wrote

| > It reads to me as just ninny advice for people who
| > don't deal with details.
| | Who's advice ? In the above you've quoted me, but somehow I think you're
| talking about/to David.
| Yes, I'm talking about the article. It assumes that people
can't be bothered to come up with email names.

| > But what's with +? He seems to be saying that POP3
| > or IMAP won't count what comes after, so rudy+amazon@gmail
| > will automatically go to rudy@gmail?
| | That was what I had problems with too, and asked about. If so it would
be
| downright stupid.
| | But as I currenly only have some "best guesses" about that I can't answer
| you with any kind of authority there I'm afraid.
| | > Since when? Is that an official SMTP rule?
| | I have no idea. I can't even remember having ever come across anything
| talking about it.
| Odd. If you don't know.... :)
The article seems to make no sense otherwise, because
there would be no way email for rudy+amazon would ever
be sent to rudy.

"Zaidy036" <Eric@Bloch.com> wrote

| Gmail Plus Address
| | So what is a Gmail Plus address? Say you have an email address like
| billgates@gmail.com. If you append a “plus” sign to your email
username,
| Gmail will ignore anything written between the + and @ sign in the email
| address and still deliver the message to the same mailbox.

So this whole thing is about gmail nonsense? Yet
Kreps never mentioned that it was only relevant for gmail.
And this guy is a security expert? He sounds like a hen
living in a foxhouse.

Mayayana,

> Yes, I'm talking about the article.

So no, you where not talking to me not David, but about the "Krebs on
Security" article I posted a link to.

> It assumes that people can't be bothered to come up with
> email names.

All I see is a way to make up an email address when needed - without having
to go thru the email hosts hoops to create one - and do the nitty-gritty
(the filtering) when at home - without, again, having to bother the email
host.

> | > Since when? Is that an official SMTP rule?
> |
> | I have no idea. I can't even remember having ever come across
> | anything | talking about it.
> |
> Odd. If you don't know.... :)

Why ? I know that its offered, but can't find any kind of specifics about
it.

> The article seems to make no sense otherwise, because
> there would be no way email for rudy+amazon would ever
> be sent to rudy.

Ah, you assume I only think about problems that turn up at my doorstep. :-)

Not quite. Sometimes I get caught by some percieved(?) problem with
something, and want to know more about it. Just to know what I should
decide if its ever offered to me.

Regards,
Rudy Wieser

R.Wieser <address@not.available> wrote:
> Frank,
>
> > Plus addressing is not meant to protect the main email address.
> > It's meant to be used for filtering incoming mail. They are not
> > email aliases, but alternatives for email aliases.
>
> Thats the problem : The idea is to create an identifiable email address. But
> a bad player could just cut the "+" phrase outof it and start to spam the
> resulting email address. No way to figure out who the company was which
> "+" phrase was removed.
>
> IOW, it /sounds/ like a good thing, but, in the situation you describe, the
> user has to be rather carefull with it. Probably not use the base email
> address for anything, and throw anything addressed to it away.

It's not a "problem" and it *is* "a good thing", it's just not meant to
provide protection against spam.

It also sucks at mowing your lawn. Sorry about that.

Moral: Use it or don't use it. Don't misuse/abuse it.

> "For example, suppose you gave someone the address
> username+hiking@domain.tld. Any messages sent to this address will be
> delivered to username@domain.tld,"
>
> Thats the whole problem in a nutshell. Someone over at fastmail did not
> think about the nuissance implications of that. :-(

Nope. For MSPs who handle plus-addressing - i.e. in this case
Fastmail - the mail will *not* be delivered to username@domain.tld's
*Inbox*, but to the *folder* 'hiking'. That's the whole point of
plus-addressing.

(Zaidy036 mentioned that Gmail apparently ignores the +<tag> part and
just delivers the message anyway, which AFAIK is the correct way to do
it. It doesn't say if the +<tag> part is preserved in the 'To/Cc' header
of the received message, so it's unknown if the tag can be used for
filtering. Yes, I could test that, but I won't.)

Mayayana <mayayana@invalid.nospam> wrote:
> "Zaidy036" <Eric@Bloch.com> wrote
>
> | Gmail Plus Address
> |
> | So what is a Gmail Plus address? Say you have an email address like
> | billgates@gmail.com. If you append a ???plus??? sign to your email
> username,
> | Gmail will ignore anything written between the + and @ sign in the email
> | address and still deliver the message to the same mailbox.
>
> So this whole thing is about gmail nonsense? Yet
> Kreps never mentioned that it was only relevant for gmail.
> And this guy is a security expert? He sounds like a hen
> living in a foxhouse.

Easy does it! Again loudmouthing/insulting about stuff you don't
understand (and no, the question marks don't get you of the hook).

Sorry to rain on your parade, but this is *not* "gmail nonsense".

Gmail (apparently, taking Eric's word for it) handles plus-addressing
in a non-destructive way. Good on Gmail! FYI, my main MSP just fscks up.
:-(

FWIW, AFAIK plus-addressing is a de jure or de facto standard. (Can't
be bothered to try to find it. Not my problem/question.) People use it
and for good reasons. Get over it.

Frank,

> It's not a "problem" and it *is* "a good thing",

Nope, not by long shot.

> it's just not meant to provide protection against spam.

It should also not be ment as an open invitation to a bad actor. Which, in
the form you are describing it, it definitily is.

So thank you, but you've made clear that if its implemented that way its
absolute garbage and I would not touch it with a 10 foot pole.

> Nope. For MSPs who handle plus-addressing - i.e. in this case
> Fastmail - the mail will *not* be delivered to username@domain.tld's
> *Inbox*, but to the *folder* 'hiking'. That's the whole point of
> plus-addressing.

So, you first need to set up the correct folders on the email hosts machine,
and only than you can give out a "+ address that refers to it ? Thats
bullshit. It would make the whole thing absolutily *zero* better than
creating a standard email alias.

But, maybe I misunderstood what you said there. In that case, please do
explain a bit more.

Regards,
Rudy Wieser

On 8/24/2022 2:17 PM, Frank Slootweg wrote:
> R.Wieser <address@not.available> wrote:
>> Frank,
>>
>>> Plus addressing is not meant to protect the main email address.
>>> It's meant to be used for filtering incoming mail. They are not
>>> email aliases, but alternatives for email aliases.
>>
>> Thats the problem : The idea is to create an identifiable email address. But
>> a bad player could just cut the "+" phrase outof it and start to spam the
>> resulting email address. No way to figure out who the company was which
>> "+" phrase was removed.
>>
>> IOW, it /sounds/ like a good thing, but, in the situation you describe, the
>> user has to be rather carefull with it. Probably not use the base email
>> address for anything, and throw anything addressed to it away.
>
> It's not a "problem" and it *is* "a good thing", it's just not meant to
> provide protection against spam.
>
> It also sucks at mowing your lawn. Sorry about that.
>
> Moral: Use it or don't use it. Don't misuse/abuse it.
>
>> "For example, suppose you gave someone the address
>> username+hiking@domain.tld. Any messages sent to this address will be
>> delivered to username@domain.tld,"
>>
>> Thats the whole problem in a nutshell. Someone over at fastmail did not
>> think about the nuissance implications of that. :-(
>
> Nope. For MSPs who handle plus-addressing - i.e. in this case
> Fastmail - the mail will *not* be delivered to username@domain.tld's
> *Inbox*, but to the *folder* 'hiking'. That's the whole point of
> plus-addressing.
>
> (Zaidy036 mentioned that Gmail apparently ignores the +<tag> part and
> just delivers the message anyway, which AFAIK is the correct way to do
> it. It doesn't say if the +<tag> part is preserved in the 'To/Cc' header
> of the received message, so it's unknown if the tag can be used for
> filtering. Yes, I could test that, but I won't.)

yes the +.... is preserved for filtering by GMail

"R.Wieser" <address@not.available> wrote

| Ah, you assume I only think about problems that turn up at my doorstep.
:-)
| | Not quite. Sometimes I get caught by some percieved(?) problem with
| something, and want to know more about it. Just to know what I should
| decide if its ever offered to me.
| My apologies, Rudy. I would never accuse you of not
making up problems. :)

"Frank Slootweg" <this@ddress.is.invalid> wrote

| FWIW, AFAIK plus-addressing is a de jure or de facto standard. (Can't
| be bothered to try to find it. Not my problem/question.) People use it
| and for good reasons. Get over it.

You seem to be getting awfully cranky these days, Frank.
You take offense and accuse others of bad behavior
regularly.

Maybe I misunderstood. Zaidy said it's a gmail thing.
Others seem to say it's not part of smtp. According to
the RFC for SMTP that I found, anything from Chr 32 to 126
is usable, but \ is an escape character. On the other hand,
I've never seen spaces or any other non-alphanumeric used,
except for periods, underscores and dashes.

On one site I saw someone say that gmail does not allow
+ in an address because they use it for aliases! And apparently
many sites will reject it when checking an email address entered.
Of course, if + were universally used for aliases then it couldn't
be an acceptable character as part of addresses. But there's
nothing I can see in the RFC saying that + denotes an alias.
So apparently it's gmail nonsense. Interestingly,
the author of the SMTP RFC uses + in his email address!
Everyone's a comedian. :)

So I think I'll stick with my original conclusion. This whole
thing is gmail nonsense. There's no sane reason for
anyone else to actually make up an email address with + in it.
And as you said yourself, mail servers may choke on it.

Mayayana,

> | Not quite. Sometimes I get caught by some percieved(?) problem with
> | something, and want to know more about it. Just to know what I
> | should decide if its ever offered to me.
>
> My apologies, Rudy. I would never accuse you of not
> making up problems. :)

Thank you ! I knew you would understand.

On the other hand, you're probably yanking my chain, aren't you ? :-P

Regards,
Rudy Wieser

Zaid,

> yes the +.... is preserved for filtering by GMail

That sounds quite logical, otherwise the whole reason for putting a "+" part
in the outgoing mail would be absent ...

Than again ... Its pretty-much what my previous ISP did : They allowed us
to set up an email alias, but than removed the alias from the delivered mail
(replaced it with that of the target box). Luckily they realized that that
wasn't a good idea(probably because of users asking them if they where
daft), and started to deliver the mail with the "to:" untouched. :-)

Regards,
Rudy Wieser

Mayayana <mayayana@invalid.nospam> wrote:
> "Frank Slootweg" <this@ddress.is.invalid> wrote
>
> | FWIW, AFAIK plus-addressing is a de jure or de facto standard. (Can't
> | be bothered to try to find it. Not my problem/question.) People use it
> | and for good reasons. Get over it.
>
> You seem to be getting awfully cranky these days, Frank.

You seem to hold old grudges. 'These days' is probably months ago.

> You take offense and accuse others of bad behavior
> regularly.

Your - 'conveniently' snipped insult - *is* bad behaviour, no ifs or
buts about it. Can't do the time, ...

> Maybe I misunderstood. Zaidy said it's a gmail thing.
> Others seem to say it's not part of smtp.

SMTP doesn't have anything to do with it. It's a transport protocol,
it does define e-mail address formats.

> According to
> the RFC for SMTP that I found, anything from Chr 32 to 126
> is usable, but \ is an escape character. On the other hand,
> I've never seen spaces or any other non-alphanumeric used,
> except for periods, underscores and dashes.
>
> On one site I saw someone say that gmail does not allow
> + in an address because they use it for aliases!

As Zaidy/Eric mentioned, Gmail *does* allow it, they just *ignore* it
and put the message in the user's normal Inbox.

> And apparently
> many sites will reject it when checking an email address entered.

A sending server should accept it (my main MSP does), but a receiving
server might reject it (my main MSP does).

> Of course, if + were universally used for aliases then it couldn't
> be an acceptable character as part of addresses. But there's
> nothing I can see in the RFC saying that + denotes an alias.

As I said before, it's not an alias, but an alternative for aliases,
but let's not quibble about not-quite-correct terminology.

> So apparently it's gmail nonsense. nterestingly,
> the author of the SMTP RFC uses + in his email address!
> Everyone's a comedian. :)
>
> So I think I'll stick with my original conclusion. This whole
> thing is gmail nonsense. There's no sane reason for
> anyone else to actually make up an email address with + in it.
> And as you said yourself, mail servers may choke on it.

Sigh! It's *not* "gmail nonsense". As mentioned, Fastmail also allows/
handles plus-addressing. Also, as I mentioned several Usenet posters use
plus-addressing for filtering and I'm sure most of them do not use Gmail
or Fastmail.

Why do you say "There's no sane reason..."? The reason is to be able
to filter incoming e-mail on the +<tag>.

As to "mail servers may choke on it": The *receiving* server of the
persons who *do* use +<tag> in their e-mail address obviously do *not*
choke on it. The *sending* servers of people who send to a +<tag>
address *should* not choke on it.

You might want to try the latter on your server. The message should
*not* fail on the sending server, but might/probably_will fail on the
receiving server (which will bounce the non-delivery report to the
sender.

Zaidy036 <Eric@bloch.com> wrote:
[...]

> > (Zaidy036 mentioned that Gmail apparently ignores the +<tag> part and
> > just delivers the message anyway, which AFAIK is the correct way to do
> > it. It doesn't say if the +<tag> part is preserved in the 'To/Cc' header
> > of the received message, so it's unknown if the tag can be used for
> > filtering. Yes, I could test that, but I won't.)
>
> yes the +.... is preserved for filtering by GMail

Thanks for the confirmation.

So Gmail indeed does the correct/sane thing.

You *do* realize that you've just ruined Mayayana's day, don't you!? :-)