The dots do matter: how to scam a Gmail user • Hacker News Board

Re: The dots do matter: how to scam a Gmail user

#101

Post by hv42 » Sat, Apr 07, 2018, 7:55 PM UTC

endorphone wrote: post #65

sorahn wrote: post #4

I really wish that I could tell google to bounce all the emails that don’t match my “dot pattern” I’m now in complete control of someone else’s commercial business hvac account because of precisely this problem. And the worse part is that I don’t know the correct email to get ahold of this person. They’ve set up library appointments, I received a receipt for a down payment on a lake house, basically most of this pers…

I'm now in complete control of someone else’s commercial business hvac account because of precisely this problem. But that has absolutely nothing to do with the dots. Indeed, almost every comment about this has nothing to do with the dots, including the submission. Someone entered the wrong email address, and in the process got yours. It isn't like the dotted or undotted one is legitimately theirs -- it can't possibl…

I strongly disagree with the author as well. Netflix is not doing its job.

But the scam described by the author works because he victim already has an account registered with their Gmail address.

The warning could be a good idea

also I wish the email address of both the recipient and emitter were shown in a better in Gmail.

Re: The dots do matter: how to scam a Gmail user

#102

Post by chatmasta » Sat, Apr 07, 2018, 7:56 PM UTC

zaidf wrote: post #86

chatmasta wrote: post #53

Earlier quoted context omitted.

Yep. Bug is the ability for users to charge a credit card before verifying email. Or did the victim in this blogpost also verify their email at some point? Netflix could be forgiven for thinking that updating payment details via email = verifying email. But if the victim had to respond to two emails, the first of which is a “verify email for your new account,” the phishing would be less believable. Ultimately, the vi…

The standard email verification patterns rely on the user clicking a link. I am not sure how that would have helped here. Making users retype the email (instead of merely click on a link) might be better for exposing scams but requires more work on the user’s part.

Ultimately the bug relies on how believable the emails from Netflix are. If I got an email from Netflix asking me to update card details, I wouldn’t be surprised because maybe my card expired. But if I got an email asking to verify my new account, I would be very surprised. I didn’t sign up for a new Netflix account. If after that, I got an email to update my card details, I would be alarmed because of the recent unexpected signup email.

Re: The dots do matter: how to scam a Gmail user

#103

Post by mrob » Sat, Apr 07, 2018, 7:56 PM UTC

Buge wrote: post #43

jamesfisher wrote: post #21

Earlier quoted context omitted.

I'm sorry, this sentence wasn't clear, and I agree with you. What I meant by this was: - Some would say that Netflix should verify the email address on sign up, but there's no obvious attack that this mitigates. Using someone else's address on signup only cedes account control to them. - Others would say that Netflix should disallow the registration of james.hfisher@gmail.com when a Netflix account already existed fo…

> Some would say that Netflix should verify the email address on sign up, but there's no obvious attack that this mitigates. Someone could carry out this exact attack but without dots. The attacker creates an account, associates it with your email, and hopes you put your credit card info into the account. How come the attacker didn't "[cede] account control to [you]" when the attacker put your email into the attacker…

They couldn't carry out the same attack without the dots, because the attack relies on the target mistaking the attacker's Netflix account for their own account. If you get a Netflix email when you've never signed up using that email account then it's obviously not for you.

Re: The dots do matter: how to scam a Gmail user

#104

Post by Pxtl » Sat, Apr 07, 2018, 7:57 PM UTC

I have multiple "e-mail doppelgangers" - confused people who don't know their own email address and so accidentally use my address when they register stuff.

One's in Chile. I have almost no knowledge of Spanish. The other is in California.

Having experienced this:

Services need to email new email accounts they become aware of ASAP. They have literally zero UI available to me to notify them that this is an invalid email address. The very first interaction when a user registers an account with their email on the service needs to be "Welcome username to MyCompany.com! If you didn't create an account with MyCompany, click here to let us know and we'll remove the email address from this user's account!"

If Netflix does not do this, Netflix is doing it wrong. It also would solve your security issue - by immediately notifying the address that a new account has been created on them, it notifies the user to expect additional emails and allows them to take action immediately.

This also prevents another problem: What happens if somebody has already accidentally claimed my email address on a service I want to join? If you don't provide a way in the emails to say "that's not me", then I have no way to ever register for your service with my address.

Re: The dots do matter: how to scam a Gmail user

#105

Post by planetjones » Sat, Apr 07, 2018, 7:57 PM UTC

It’s not just Netflix. I am having the same problem. Someone has signed up to instagram, yahoo and others using a form of my mail address without the dots (the one I chose had the dots before I knew gmail didn’t care). I believe a lot of them are spam accounts. But what do I do. I don’t want to spend time trying to speak to a customer service rep for companies that don’t want to be contacted.

Instagram had a link at the bottom of the mail called ‘remove your email from this account’. I click it and it says it’s not a valid link...

I don’t want this from gmail. I want the address I signed up with. It should be simple. It’s hard to explain to others why the dots don’t matter.

Re: The dots do matter: how to scam a Gmail user

#106

Post by tempestn » Sat, Apr 07, 2018, 7:57 PM UTC

endorphone wrote: post #65

sorahn wrote: post #4

I really wish that I could tell google to bounce all the emails that don’t match my “dot pattern” I’m now in complete control of someone else’s commercial business hvac account because of precisely this problem. And the worse part is that I don’t know the correct email to get ahold of this person. They’ve set up library appointments, I received a receipt for a down payment on a lake house, basically most of this pers…

I'm now in complete control of someone else’s commercial business hvac account because of precisely this problem. But that has absolutely nothing to do with the dots. Indeed, almost every comment about this has nothing to do with the dots, including the submission. Someone entered the wrong email address, and in the process got yours. It isn't like the dotted or undotted one is legitimately theirs -- it can't possibl…

In the initial submission, without the dots issue though, the wrong address entered wouldn't be able to match an existing user.

Re: The dots do matter: how to scam a Gmail user

#107

Post by berkut » Sat, Apr 07, 2018, 7:58 PM UTC

abrowne wrote: post #61

ada1981 wrote: post #41

Earlier quoted context omitted.

I'd log in an cancel the account. Why feel wierd? Someone is using your email address without your permission. Curious how often this happens.

I have firstname.lastname (although now it just forwards to my FastMail vanity domain) and I've shut down new eBay and Amazon accounts plus received doctors appointments and even school lunch duty emails. Sometimes I respond, and I even forwarded a couple after figuring out one mis-user's real email (firstnamelastname0) when a cable company csr chat log was emailed, but they never responded so now I delete them all.

I've had the same: I have firstname.lastname, and I've had netflix, nytimes subscription, dropbox registrations (and warnings that it's full), hotel bookings, and many other things that are nothing to do with me, targeted to firstnamelastname.

I also get regularly added to conversations with other people who think I'm someone else. Again and again I've had to try and explain that they've got the wrong email address, but it happens so often now, I just don't bother now and ignore the emails.

Re: The dots do matter: how to scam a Gmail user

#108

Post by mulmen » Sat, Apr 07, 2018, 7:59 PM UTC

Relying on email providers to do the right thing (read RFCs) so you can avoid best practices is the wrong conclusion to draw here. Netflix should validate all email addresses. It's really, really basic stuff.

Re: The dots do matter: how to scam a Gmail user

#109

Post by r00fus » Sat, Apr 07, 2018, 7:59 PM UTC

ada1981 wrote: post #50

I'm pretty sure Amazon allows unlimited accounts as long as you have different passwords. This is beyond bizarre. I have at least 2 accounts with the same email and the way into it is by knowing what password leads to which one. I have yet to see what happens if I try to set both accounts to the same password.

This is hard to believe. So you're saying that they hash/bcrypt (user+pass) to determine uniqueness?

Re: The dots do matter: how to scam a Gmail user

#110

Post by dfee » Sat, Apr 07, 2018, 8:00 PM UTC

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

I see a lot of claims that email addresses should be verified prior to a transactional email being delivered - that that’s the “norm” or stupidly obvious way.

But when there is a real consequence on a conversion funnel for requiring email address verification (say ecommerce), I imagine the obvious business decision is to do the exact opposite.