Normalize emails for uniqueness

[digitalpoint]

Spammers leverage Gmail (and other email providers) ability to create multiple accounts using the same Gmail account, but each account has a "unique" email address by leveraging dots (".") and pluses ("+") in the email address.

For example, these all go to the same Gmail account inbox:

spammer@gmail.com
spam.mer@gmail.com
s.p.a.m.m.e.r@gmail.com
spam.m.e.r+xenforo@gmail.com

Dots are ignored and anything between + and @ are also ignored when routing to an inbox.

More info: https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-more-from-your.html

A few years ago I built an addon that normalized a user's email address with a preg_replace like so:

$normalizedEmail = preg_replace('/(?:\\.|\\+.*)(?=.*?@gmail\\.com)/m', '', $email);

The one I did was for Gmail specifically, but it looks some of the the major free email providers support the same thing now:

You can now use "+" email aliases on Outlook.com - gHacks Tech News

Google some years ago introduced "+" aliases to Gmail which enabled you to use address variations without changing your email address at all. It allows you to add additional text to the […]

www.ghacks.net

Anyway, long story short is you could add a hidden column to the xf_user table that stored the normalized email address that must be unique (and it's updated when the user's normal email is updated via the User entity). As a result you would cut out a whole lot of spammers that are using that to create multiple accounts.

 

[Mouth]

Great idea, we really need XF to support this.

 

[Imgbi]

This will be a great idea for small addon.

 

[Alpha1]

It would be nice to see this in core.. Until that time, maybe @Xon can add this to:

Signup abuse detection and blocking

From (simple) multiple accounts detection to isp/connection fingerprinting with score-based moderating/rejecting logic. These are very effective low-hanging fruit at reducing spam. Supports migration configuration from the following XF1 add-ons...

xenforo.com

 

[Imgbi]

It would be nice to see this in core.. Until that time, maybe @Xon can add this to:

Signup abuse detection and blocking

From (simple) multiple accounts detection to isp/connection fingerprinting with score-based moderating/rejecting logic. These are very effective low-hanging fruit at reducing spam. Supports migration configuration from the following XF1 add-ons...

xenforo.com

$45?

 

[Alpha1]

Yes, its very cheap.

 

[Imgbi]

Yes, its very cheap.

Cheap?
You know that amount is the minimum salary in my country?

 

[Alpha1]

Complex software requires many hours of development and testing. If you consider what you get and how many hours go into it, then its very cheap.

 

[Imgbi]

Complex software requires many hours of development and testing. If you consider what you get and how many hours go into it, then its very cheap.

I didn't disagree with you.
It may be cheap to some but at my end, $45 is expensive.

 

[duderuud]

$45 is a bargain for the amount of work involved to build such an addon.