Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My question is based on this tweet after I commented about forbidding + symbols in email addresses. The tweet says, "This is a measure we've taken for security reasons."

This can be frustrating and inconvenient for people that have (or use) plus signs in their email address, and I'm sure web sites don't intend to do that. I'm unaware of the security vulnerabilities related to using the + character; is this something I should change to improve my own security? What is the security reason for a web site to disallow that character on an email field?

Update: Meetup Support responded positively. Turns out it's more of a UX issue than a security one. They clarified in this tweet that they disallow + to prevent spam (?) and they acknowledged a suggestion for improving the user experience. (My intent here was not to gripe about Meetup; let's be gentle! I wanted to make sure I was not missing something important in my own web sites that receive email addresses.)

share|improve this question
38  
I doubt they have any valid security reason, rather they are just lazy and don't want to fix it. –  user2813274 Aug 12 at 19:19
2  
As an aside, it may be possible to bypass that validation if it is done client-side (IE by javascript). Also, @martialdidit, you should just mark the question as a favorite and not comment saying that it is something you will come back to. –  Matthew Peters Aug 12 at 19:53
6  
One reason is that, at least with Gmail, anything after the + is ignored. That means that example+a@gmail.com, example+b@gmail.com, etc. are all delivered to example@gmail.com's email. This is useful in finding out who is selling your information. For example, if I sign up for Fabrikam Inc.'s newsletter with example+fabrikam@gmail.com, and I get an email from Contoso Ltd. directed to example+fabrikam@gmail.com, I'll know Fabrikam is selling my information. –  Cole Johnson Aug 12 at 22:54
15  
related: "plus haters" –  David Cary Aug 13 at 2:47
7  
This reminds me of another silly tweet from last year –  Lightness Races in Orbit Aug 13 at 16:00

4 Answers 4

up vote 65 down vote accepted

There is no security vulnerability per se with having a '+' in your email address. It's permitted as per RFC 2822, and not particularly useful for SQL or other common forms of injection.

However, many systems (let's call Meetup a system for this purpose) enforce security through whitelisting, not blacklisting. Someone defined a limited list of characters they expected to see in email addresses (probably upper, lower, numeric, ., _, and -) and wrote a filter to block anything outside that list. And they didn't think anyone would use +, so you're out of luck.

This article describes how to set up Postfix to tag, and to use '-' instead of '+' because:

However, during a recent discussion on the Postfix user list, it was mentioned that some websites (particularly banks) use JavaScript to try and validate email addresses when they are entered into online forms, and that many don’t allow the plus symbol as a valid character in an email address.

I switched from '+' to '-' over a decade ago, for similar reasons.

share|improve this answer
    
Ah, that's a cool trick with Postfix. Thanks for the extra tip! –  Matt Aug 12 at 19:53
3  
Can you use a combination of + and -? I know gmail will attempt to filter your + tags into separate labels where possible, ie, my.email+spam@gmail.com will send any emails from that particular service to the spam tag. I've never tried my.email-spam@gmail.com though. –  Seiyria Aug 13 at 0:51
    
In short, both + and - are legal characters and you can use both, in any combination, in your email address. However, it's up to your mail server how that's handled. Courier and Postfix both support tagging with simple configuration settings, but I don't think either will support two tag markers without extra work. YMSMV (Your Mail Server May Vary). –  gowenfawr Aug 13 at 12:07
2  
If you're not running your own mail server, you can't control how they will process a hyphen. In most cases, "doktor-spam@example.com" is a completely different email address/account from "doktor@example.com". OTOH, most providers treat "doktor+spam@example.com" the same as "doktor@example.com", allowing you to use it for client-side filtering purposes. –  Doktor J Aug 13 at 17:54
    
It's important to note that according to RFC 822 the only characters explicitly not allowed are: ( ) < > @ , ; : \ " [ ] (technically . belongs here too, but it's handled a little differently, and is permitted in a fashion) –  Doktor J Aug 13 at 18:04

They are likely incompetent and may not even know they are lying to you.

From a input-validation standpoint, they have no leg to stand on; there are a specific set of RFCs that robustly describe the format of a valid email address. Even if an email address is technically invalid according to the RFC, it may still be possible to deliver mail to it anyway. You can check an email address is deliverable by sending mail to it with a unique link for the owner to click on.

As the linked site says:

Sadly, many websites won't let you register an address with a plus sign in it. Not because they are trying to defeat your tracking strategy but just because they are crap. They've copied a broken regular expression from a dodgy website and they are using it to validate email addresses. And losing customers as a result.

Even if we assume they have completely broken code and they are using a crap validator because they literally paste the validated email address into a UNIX shell, that still doesn't give a valid reason why joe.bloggs+meetup.com.better.not.sell.this.to.spammers@example.com should be considered invalid.

There is no valid security reason to ban the use of + in email addresses. Even if spammers use it as a low-rent way of making multiple accounts, websites can easily see if someone signed up both as joe.bloggs+1@example.com and joe.bloggs+2@example.com; if Joe Bloggs is abusing their service, they can easily ban both accounts. Anyone with their own mail server can generate valid email addresses like joe.bloggs1@example.com, joe.bloggs2@example.com. They gain no additional security by prohibiting the use of +.

share|improve this answer
1  
That was my thinking too but I wasn't quite sure. Thanks for the explanation. I assume that most of these sites aren't really incompetent, but it's probably likely that there is misinformation and wild assumptions that go on. So I guess the real issue at hand is more of a UX thing, not security. –  Matt Aug 12 at 20:09
3  
So maybe the "security reason" is that they're selling your email address to spammers, and trying to secure themselves against users identifying them as the vendor ;-) Of course they'll fail for the reason you say, that someone with their own domain will figure out what they're doing. –  Steve Jessop Aug 13 at 12:28
    
"Anyone with their own mail server can generate valid email addresses" there are also some existing mail services which permit all usernames as valid (eg, mailinator.com and its aliases) –  Brian S Aug 14 at 22:50
    
Well, they might be accepting the email address as GET parameter somewhere and post it onto a Unix shell without validation (turning the plus into a space). Of course, in that case, the whole approach of not allowing a character rather than doing a proper validation is so stupid that the "solution" is kind of ill... –  Damon Aug 15 at 8:15

As others have pointed out, there are no real security reasons to disallow a plus sign in email address.

Being a web developer, the main reason I can think of is to prevent users from making multiple registrations using different aliases, especially on an E-commerce website where you have a one-time free offer that you want to limit to each individual.

From the point of view of a database administrator, an extra query on the database has to be made if you want to accept the plus symbol and at the same time limit the registration of email to one alias per email address. Otherwise setting UNIQUE key on the email address would be sufficient to prevent an INSERT if the email address is a duplicate.

The above reasons are a combination of technical and commercial decisions which would not be easily explained in a line of words. If you are using an alias in your email address, an easy solution is to drop that part off in order to register.

share|improve this answer
    
The DBA perspective is refreshing, thanks! I would suppose, though, that a little pre-processing of the email address to strip out the plus-portion could save that extra query. This steps into UX bounds, but is interesting since, as you suggest, I should be able to change my email address to have a plus-sign later without negative consequence. (I agree; but I doubt most sites implement it that way.) –  Matt Aug 13 at 13:55
1  
Yup. It's a bunch of extra work. I personally use + to understand who's selling my data. But to handle it properly in websites I've worked on, I'd need an extra field in the DB, to enforce "one free account per email address" - I'd need to record a field with the users' chosen email address, and then a field parsed to remove the decoration - and check the undecorated field for uniqueness, alone, never using it for any other purpose. That's a lot of effort for little benefit to the website. Easier to say "Nah. No plusses in email addies, innit. Security, mate, security - no telling you, eh?". –  JezC Aug 13 at 18:21
1  
@Matt, as the RFC standard did not restrict the usage of + symbol to aliases, there is no way for website owners to have their cake and eat it too. Users with uncommon email address are going to be left once a decision is made to exclude aliases for registration. And I am not suggesting that you are able to add back your alias subsequently after registration as I believe the same validation rules would apply for email change. –  Question Overflow Aug 14 at 2:53
2  
"to prevent users from making multiple registrations using different aliases" - I would imagine that if people really wanted to get multiple free offers they would just create a multiple accounts. I'd imagine more people know about free email accounts then aliases in gmail. –  Maciej Piechotka Aug 14 at 17:23
1  
@QuestionOverflow So the business rules dictate that users using gmail, yahoo, hotmail and other similar accounts are blocked by default? Given that those 3 domains have over 96% of US market share (sorry I could not find worldwide data) it sounds like loss from deterred clients would by magnitudes larger then any possible loss from a few free riders - unless it's very specific bushiness and can afford to, say, accept only addresses from universities. –  Maciej Piechotka Aug 16 at 9:19

The only security reason I can think of is that they are using regular expressions to process emails and their software is crap, does not escape addresses properly and they hit errors. Maybe a far guess but I've seen issues related to email addresses with + and regular expressions. In any case, conclusion is that these sites are crap.

share|improve this answer
1  
Oh, I dunno about that. Their site works really well for arranging meetups and I've enjoyed the ones I've attended. Though the problem may reflect a poor UX decision, if all it takes is to change some regular expression, that really has little to do with the effectiveness of the service as a whole. –  Matt Aug 13 at 17:59
    
If you want a + in Regex, you just use \+. It's basic Regex. –  Cole Johnson Aug 13 at 19:00
1  
If that were the case, they would probably not support periods either (which they do). –  Fuzzy76 Aug 14 at 8:29
    
@ColeJohnson No, in a basic regular expression, if you want +, you use \+. Beware of accidental uses of technical terms! –  Gilles Aug 14 at 12:41
    
@Fuzzy76, I've seen most of the times dots used in regular expressions without escaping. Many programmers just don't think that much. But dot's do not break matching of valid use cases and often are not noticed for a long time or forever. I've also seen dots escaped in character classes, which is another issue. You guys are confusing "what they can do" with "what they do". Escaping a user supplied string requires some thought to do properly. Blocking spam with disallowing + is equally lame. If it was so easy to prevent spam, there would have been no spam already. –  akostadinov Aug 18 at 6:26

protected by Rory Alsop Aug 13 at 19:31

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.