Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Is + in email addresses a security vulnerability for authentication algorithms? How can it be used in a malicious way? Should we forbid emails with + signs during registration?
For example we have 2 accounts that correspond to 2 different identities however they were registered with the same email address with + sign
This sounds a bit like an XY problem. You could block the use of a + sign in emails on the basis that some providers use this for subaddressing. But there are still lots of other things that a user can do, including:
[email protected] and [email protected].[email protected] and [email protected] both point to the same mailbox.*@example.org points to one mailbox.[email protected], or sharing the password for their email with multiple other individuals.Ultimately, you cannot guarantee that an email address corresponds to a single individual, and you cannot guarantee that an individual person only has a single email address.
As an example, imagine you get three accounts registered:
Unless you know the exact configuration of my mailserver, there is no way that you can know whether those addresses correspond to one, two or three mailboxes. And there's also no way that you can know how many individuals have access to each of those mailboxes.
So on that basis, I don't see how blocking the use of a + sign in email addresses will help, unless your application is unable to process them. But then it's not clear exactly what the security problem that you are trying to solve is.
The use of a plus sign + in an email address is a useful feature. Gmail, as well as many other mail providers will deliver mail addressed to [email protected] as though it were addressed to [email protected].
The +tag portion of the email address can then be used both for purposes like registration and filtering emails into the inbox.
It's very useful when a user is trying to find out the source of spam emails and can use it to block any future correspondence from the spam provider or organize the emails with Tags / Folders.
How can it be used in a malicious way?
The only way it can be used maliciously is by multiple sign-up spam or user registrations.
Most of the providers do have security measures to prevent signup spams from automated bots/scripts like: rate-limiting, captcha, etc. So, if you have these measures already in place, you are ok.
Should we forbid emails with + signs during registration?
It depends on the specific business use case. If it requires a user to register only once, you can check for it during registration and if an account already exists with any variant (user<*>@example.com), then you might disallow this with something like:
"User already exists with that email."
+tag appended to the end of the account name, but that doesn't address the bigger issue. [email protected] is the same as [email protected]. Instead, as I said in comments, you should strip those characters and added bits for internal handling.
+tag and u.s.e.r behaviour dependant on the mail server and its implementation? I know Gmail for example does the first one, but I think my own mail server doesn't do that (I think, I'm not sure). I just want to clarify and not attack or something like that..
Aug 7 at 16:02
.too..... But that's not a security problem or vulnerability. That's just business logic in your program. You didn't know about the special characters and didn't account for them. That's a programming thing, not a security thing.