2

Is + in email addresses a security vulnerability for authentication algorithms? How can it be used in a malicious way? Should we forbid emails with + signs during registration?

For example we have 2 accounts that correspond to 2 different identities however they were registered with the same email address with + sign

11
  • 4
    Why would you think there was a security issue? It's a valid character in an email address. Are non-letter characters a surprise? There are a few valid special characters, like . too.
    – schroeder
    Commented Aug 7, 2023 at 13:15
  • @schroeder if the platform requires having unique email addresses for each user it could be be exploited in a scenario when one email address corresponds to 2 different users
    – user228062
    Commented Aug 7, 2023 at 14:38
  • Same with . ... But that's not a security problem or vulnerability. That's just business logic in your program. You didn't know about the special characters and didn't account for them. That's a programming thing, not a security thing.
    – schroeder
    Commented Aug 7, 2023 at 14:47
  • 1
    Do not deface your posts
    – schroeder
    Commented Aug 7, 2023 at 20:23
  • 1
    @kenlukas: No, gmail does not treat them the same. It treats one as an alias of the other, but it absolutely will preserve all the aliased addresses and you can write filters and rules that distinguish.
    – Ben Voigt
    Commented Aug 7, 2023 at 22:38

2 Answers 2

8

This sounds a bit like an XY problem. You could block the use of a + sign in emails on the basis that some providers use this for subaddressing. But there are still lots of other things that a user can do, including:

  • Adding periods or other characters to the address that their mailserver ignores (as other have suggested).
  • Registering multiple emails like [email protected] and [email protected].
  • Creating aliases so that [email protected] and [email protected] both point to the same mailbox.
  • Creating a wildcard so that *@example.org points to one mailbox.
  • Registering using a shared account like [email protected], or sharing the password for their email with multiple other individuals.
  • Registering using a free email provider that doesn't require passwords.

Ultimately, you cannot guarantee that an email address corresponds to a single individual, and you cannot guarantee that an individual person only has a single email address.

As an example, imagine you get three accounts registered:

Unless you know the exact configuration of my mailserver, there is no way that you can know whether those addresses correspond to one, two or three mailboxes. And there's also no way that you can know how many individuals have access to each of those mailboxes.

So on that basis, I don't see how blocking the use of a + sign in email addresses will help, unless your application is unable to process them. But then it's not clear exactly what the security problem that you are trying to solve is.

0

The use of a plus sign + in an email address is a useful feature. Gmail, as well as many other mail providers will deliver mail addressed to [email protected] as though it were addressed to [email protected].

The +tag portion of the email address can then be used both for purposes like registration and filtering emails into the inbox.

It's very useful when a user is trying to find out the source of spam emails and can use it to block any future correspondence from the spam provider or organize the emails with Tags / Folders.

How can it be used in a malicious way?

The only way it can be used maliciously is by multiple sign-up spam or user registrations.

Most of the providers do have security measures to prevent signup spams from automated bots/scripts like: rate-limiting, captcha, etc. So, if you have these measures already in place, you are ok.

Should we forbid emails with + signs during registration?

It depends on the specific business use case. If it requires a user to register only once, you can check for it during registration and if an account already exists with any variant (user<*>@example.com), then you might disallow this with something like:

"User already exists with that email."

3
  • Your process works for +tag appended to the end of the account name, but that doesn't address the bigger issue. [email protected] is the same as [email protected]. Instead, as I said in comments, you should strip those characters and added bits for internal handling.
    – schroeder
    Commented Aug 7, 2023 at 15:57
  • 2
    Hold on, isn't this +tag and u.s.e.r behaviour dependant on the mail server and its implementation? I know Gmail for example does the first one, but I think my own mail server doesn't do that (I think, I'm not sure). I just want to clarify and not attack or something like that.. Commented Aug 7, 2023 at 16:02
  • @SirMuffington it obviously depends on the configuration of the mail provider. If you host your own using postfix, you're going to have different results. But since the Answer chose Gmail as an example, then the bigger issue needs to be addressed (no pun intended), too.
    – schroeder
    Commented Aug 7, 2023 at 17:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .