Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The dots do matter: how to scam a Gmail user

jameshfisher.com

Post reply on HN
Print view View original

41–50 of 518 posts

Re: The dots do matter: how to scam a Gmail user

#41

Post by ada1981 »

gnicholas wrote: post #33

> but I also have access to the account because I own james.hfisher@gmail.com, and so I can follow the password reset process for this account. I did so. I wonder if others feel that it is ethical or unethical to log into other people's accounts in this situation. I get lots of emails resulting from people typo'ing my email address instead of theirs—and the unsubscribe links are often hidden behind a login page. But…

I'd log in an cancel the account. Why feel wierd? Someone is using your email address without your permission.

Curious how often this happens.

Re: The dots do matter: how to scam a Gmail user

#42

Post by AndrewSnow »

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

Absolutely. I don’t blame people who don’t interact with email for not reading the relevant RFCs, but not verifying control and expecting local part uniqueness to mean uniqueness of users is obviously busted to anyone who has worked with email. This is Netflix failing to understand part of their product surface.

Both the dot behavior and the even more common ‘+’ feature are perfectly spec compliant.

Re: The dots do matter: how to scam a Gmail user

#43

Post by Buge »

jamesfisher wrote: post #21
Buge wrote: post #11

>Where is the security flaw here? Some would say it’s Netflix’s fault; that Netflix should verify the email address on sign up, or that Netflix should disallow the registration of james.hfisher@gmail.com when a Netflix account already existed for jameshfisher@gmail.com. But such policies would not add security, and would force Netflix and every other website to have insider knowledge of Gmail’s canonicalization algor…

I'm sorry, this sentence wasn't clear, and I agree with you. What I meant by this was: - Some would say that Netflix should verify the email address on sign up, but there's no obvious attack that this mitigates. Using someone else's address on signup only cedes account control to them. - Others would say that Netflix should disallow the registration of james.hfisher@gmail.com when a Netflix account already existed fo…

> Some would say that Netflix should verify the email address on sign up, but there's no obvious attack that this mitigates.

Someone could carry out this exact attack but without dots. The attacker creates an account, associates it with your email, and hopes you put your credit card info into the account.

How come the attacker didn't "[cede] account control to [you]" when the attacker put your email into the attacker's account? The control issue seems the same regardless of how dots are treated.

Re: The dots do matter: how to scam a Gmail user

#44

Post by ChicagoDave »

I just got a non-dot response to someone paying their Duke Energy bill, addressed to my name. I did find another person with my name in Indiana so maybe they screwed up their rmail? I checked my credit and I have no fraud activity, so it’s just weird.

I don’t like the dots-don’t-Matter policy. It’s just an opportunity for abuse.

Re: The dots do matter: how to scam a Gmail user

#47

Post by sorahn »

ocdtrekkie wrote: post #9
sorahn wrote: post #4

I really wish that I could tell google to bounce all the emails that don’t match my “dot pattern” I’m now in complete control of someone else’s commercial business hvac account because of precisely this problem. And the worse part is that I don’t know the correct email to get ahold of this person. They’ve set up library appointments, I received a receipt for a down payment on a lake house, basically most of this pers…

Do you also, by chance, have a short Gmail address? I've also definitely gotten signups from other individuals mistyping their address on my six letter account. My comedy ownership of someone else's identity is a Staples account. Presumably someone in New York with a similar name had a store person look up their Staples account, which was actually my Staples account, and associate their business name with it. Their b…

It’s not too short. 12 characters including the name separating dot.

This person that recently started using this email is using the same name but with no dot.

first.lastname@gmail is what I use, and now I’m getting a bunch for firstlastname@gmail.

Some of these emails look pretty important too, if I had malicious intent, I could probably ruin and or steal this persons identity and or business with the specific mail that I’ve received recently.

I’m really amazed at the lack of confirmation of emails before sending things like your HVAC business license, or city contracting permits, that have other people’s identifying information in them too.

Re: The dots do matter: how to scam a Gmail user

#48

Post by mholt »

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

What great timing -- I've been fighting Uber on this very issue as of last night: https://twitter.com/mholt6/status/982414407941611520

Re: The dots do matter: how to scam a Gmail user

#49

Post by slartibardfast0 »

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

completely agree, I've a rather common name with a corresponding gmail, it's absolutely shocking how little validation major Airlines do around emails!

Re: The dots do matter: how to scam a Gmail user

#50

Post by ada1981 »

I'm pretty sure Amazon allows unlimited accounts as long as you have different passwords.

This is beyond bizarre. I have at least 2 accounts with the same email and the way into it is by knowing what password leads to which one.

I have yet to see what happens if I try to set both accounts to the same password.

Post reply on HN