The dots do matter: how to scam a Gmail user • Hacker News Board

Re: The dots do matter: how to scam a Gmail user

#51

Post by zAy0LfpBZLC8mAC » Sat, Apr 07, 2018, 7:36 PM UTC

Really, it was simply your mistake for following a link in an email and then entering credentials where you landed, i.e.. you fell for phishing.

The idea that a company should only accept one account per email address is bullshit (it a contact address, not an identity), and if they don't do that, any of that "don't allow any aliases for email addresses" on the part of the email provider would be completely pointless anyway. You simply don't use context delivered by email as a starting point for disclosing credentials, and you have solved all (email) phishing attacks.

Re: The dots do matter: how to scam a Gmail user

#52

Post by ESRogs » Sat, Apr 07, 2018, 7:36 PM UTC

jamesfisher wrote: post #16

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

I think these are orthogonal issues. The dots do matter, but Netflix should also validate email addresses. However, I don't think it's as critical. Lack of email validation means I receive someone else's ride details (I agree, annoying), but dots-don't-matter means I might accidentally pay for that person's rides.

If Google fixed dots-don't-matter, couldn't someone still sign up for Netflix with jameshfisher+netflix@gmail.com?

If Netflix checks for + address duplicates, then that's not an issue. But you could still have the situation where someone signs up for, let's say, Hulu with your standard jameshfisher@gmail.com account. And then you could still end up paying if you forget whether you ever signed up for Hulu or not (maybe you were about to sign up and didn't, maybe you planned to in the future).

Email validation seems like the most important defense against this kind of thing. Dots mattering seems secondary.

Re: The dots do matter: how to scam a Gmail user

#53

Post by chatmasta » Sat, Apr 07, 2018, 7:37 PM UTC

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

Yep. Bug is the ability for users to charge a credit card before verifying email.

Or did the victim in this blogpost also verify their email at some point?

Netflix could be forgiven for thinking that updating payment details via email = verifying email. But if the victim had to respond to two emails, the first of which is a “verify email for your new account,” the phishing would be less believable.

Ultimately, the viability of a phishing scheme depends on the plausibility of receiving an email from a source. In this case, Netflix does send emails about updating your card details when a subscription charge fails, so plausibility of receiving the email from Netflix is high.

Another symptom that this is a bug with Netflix is that they granted the ability for one user to trigger a crafted email to another user.

Re: The dots do matter: how to scam a Gmail user

#54

Post by zAy0LfpBZLC8mAC » Sat, Apr 07, 2018, 7:37 PM UTC

HankB99 wrote: post #40

Alex3917 wrote: post #10

This is exactly why you need to normalize email addresses. The people who wrote the email RFCs just plain got it wrong, so it’s up to every SaaS site to do this so that they aren’t putting their users at risk. If someone is using an email with that’s the same as someone else’s except for the capitalization, it should be on them to get a new email address.

My understanding is that the RFCs define how the Internet work so by definition, they are not wrong. You're certainly free to assert that they made a bad decision and I'm not qualified to offer an opinion on whether you are right or wrong. However since Netflix is not managing email addresses in accordance with RFC-5322 They are clearly wrong.

> However since Netflix is not managing email addresses in accordance with RFC-5322 They are clearly wrong.

Where are they not?

Re: The dots do matter: how to scam a Gmail user

#55

Post by mayneack » Sat, Apr 07, 2018, 7:37 PM UTC

I prefer creating a unique email alias from dots more than plus. Especially if I sign up for something I'm worried will leak my email address to a third party, I use the dots. A malicious sharer of emails could trivially strip all the "+site@gmail.com" before sharing, but they can't know ahead of time if they get my primary email by adding or removing dots.

Also, a few times when I've signed up with "name+service@gmail.com", I've then failed to unsubscribe because their unsubscribe form didn't accept the + but the subscription form did.

Re: The dots do matter: how to scam a Gmail user

#56

Post by Pxtl » Sat, Apr 07, 2018, 7:38 PM UTC

I frequently use the dots-dont-matter feature as a substitute for plus-labeling when dealing with sites that prohibit pluses in their email addresses (which is painfully common).

That said, I have a firstname.lastname Gmail account and I get a lot of email following this problem:

https://xkcd.com/1279/

And some have the dot, and some don't. Piles of services. Sometimes I get confused for a second because they're services I use.... but maybe registered under a different account.

The number of emails that don't include a "this is not me" link in them is pathetic. Or that require you to sign in with a username and password to contact support.

Re: The dots do matter: how to scam a Gmail user

#57

Post by csydas » Sat, Apr 07, 2018, 7:39 PM UTC

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

Why can't it be both sides' issue? I have a fairly uncommon first and last name, but I still get emails from the few folk who share my name combination, and I too have gotten sensitive information that I shouldn't have.

I cannot imagine the strangeness that must occur for folks with more common name combinations, and the idea that e.mail@gmail.com is the same as email@gmail.com just seems wrong to me. As far as I know, all other email services and providers treat such accounts as unique, and it's a strange situation with very limited benefit to the end user. While I have made use of "the dots don't matter", it's always been as a way of circumventing account restrictions. The casual convenience of "dots not mattering" seems like it's overshadowed by the difficulty this can cause (as evidenced with the article and my own experience)

Re: The dots do matter: how to scam a Gmail user

#58

Post by fiddlerwoaroof » Sat, Apr 07, 2018, 7:41 PM UTC

aaossa wrote: post #13

gcb0 wrote: post #2

netflix security suck for not doing email confirmation and the ONLY email to be sent to the updated address being a billing one. and no, it should never "know about" the dot feature in gmail. that is working as intended all around. it's simply that netflix put user bounce rate metric in front of protecting users from scam. plain and simple.

IMO It's not Netflix fault, actually emails with dots in different positions should be different emails. Also, not sending a confirmation email is a common pattern now. Maybe an email about "you created an account :D" should be enough mitigation, but this is not their fault.

The thing is, the handling of the local part is MTA specific: you cannot just assume that different local parts correspond to different people because of aliases, +foo addresses and the fact that the administrator of the MTA can set whatever equivalence rules they like: I, for example, use - instead of + because so many internet forms reject + as a valid email character.

The only sane way to handle this is email-based confirmation.

Re: The dots do matter: how to scam a Gmail user

#59

Post by tanu057 » Sat, Apr 07, 2018, 7:42 PM UTC

Just test dots sont matter, And really they don't matter

Re: The dots do matter: how to scam a Gmail user

#60

Post by Pxtl » Sat, Apr 07, 2018, 7:42 PM UTC

jameskilton wrote: post #5

One interesting thing to note, for GSuite accounts, the dots do matter. first.last@company.com is not the same account as firstlast@company.com.

Perhaps they realized their mistake but knew it was too late to change it without harming users who relied on the dot aliasing, and so only eliminated it for the newer system?