On: The dots do matter: how to scam a Gmail user

[tass]

Gmail could let you specify a list of valid addresses:

first.mid.last, firstmidlast, firstmid.last

Any others bounce or display the warning header suggested in the article.

[mulmen → tass]

That's exactly how it works today with the added benefit that the user does not have to enumerate the list and it's hard for other people to squat on slight variations to your email.

[nebulous1 → mulmen]

That isn't how it works today. They do not display any warning, and you have to hover your name to see what address it was sent to.

[Avamander → nebulous1]

The infuriating part is that one can't reply from the address it was sent to, only from the one that's primary.

[0xCMP → Avamander]

Yes, in fact this is one of the more annoying parts of this feature. When you're doing a support thing you usually have to reply with the exact same email. In my Google Suite account I have many domains setup to a single account and often times a reply uses my main account instead of an alias+domain I've setup on the account which received the email.

Would be nice to be able to easily reply as any of those combinations and default to the one it was sent to (dots, +'s, and domain).

[rocqua → mulmen]

Canonization for deliverarbility (the enumerated list) can differ from canonization for uniqueness check (ignore all dots).