Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The dots do matter: how to scam a Gmail user

jameshfisher.com

Post reply on HN
Print view View original

141–150 of 518 posts

Re: The dots do matter: how to scam a Gmail user

#141

Post by teraflop »

r00fus wrote: post #109
ada1981 wrote: post #50

I'm pretty sure Amazon allows unlimited accounts as long as you have different passwords. This is beyond bizarre. I have at least 2 accounts with the same email and the way into it is by knowing what password leads to which one. I have yet to see what happens if I try to set both accounts to the same password.

This is hard to believe. So you're saying that they hash/bcrypt (user+pass) to determine uniqueness?

Maybe, or maybe they just test the password you enter against all of the accounts when you try to log in.

However it's implemented, this is a well-known, long-standing "feature" of Amazon. I think it happened to me once when I first tried to sign up for AWS, and accidentally ended up with a second Amazon account. See http://adaptivepath.org/ideas/the-woes-of-multiple-accounts/

Re: The dots do matter: how to scam a Gmail user

#143

Post by djur »

xapata wrote: post #62
jamesfisher wrote: post #21

Earlier quoted context omitted.

I'm sorry, this sentence wasn't clear, and I agree with you. What I meant by this was: - Some would say that Netflix should verify the email address on sign up, but there's no obvious attack that this mitigates. Using someone else's address on signup only cedes account control to them. - Others would say that Netflix should disallow the registration of james.hfisher@gmail.com when a Netflix account already existed fo…

Why are dots special? I have several email addresses that all find my inbox. Heck, I've done this annoying identity split to myself by accident, creating two accounts with a product I only wanted one account for.

People can't automatically derive those other email addresses. The existence of xapata@somehost doesn't allow assuming the existence of xapata.spam@somehost, but the existence of xapata@gmail does allow assuming the existence of xa.pa.ta@gmail.

Re: The dots do matter: how to scam a Gmail user

#145

Post by bxu »

ada1981 wrote: post #50

I'm pretty sure Amazon allows unlimited accounts as long as you have different passwords. This is beyond bizarre. I have at least 2 accounts with the same email and the way into it is by knowing what password leads to which one. I have yet to see what happens if I try to set both accounts to the same password.

Is this really possible? So when you reset password, anyone know which account will it reset?

Re: The dots do matter: how to scam a Gmail user

#146

Post by mcpherrinm »

Pxtl wrote: post #114
ESRogs wrote: post #52

Earlier quoted context omitted.

If Google fixed dots-don't-matter, couldn't someone still sign up for Netflix with jameshfisher+netflix@gmail.com? If Netflix checks for + address duplicates, then that's not an issue. But you could still have the situation where someone signs up for, let's say, Hulu with your standard jameshfisher@gmail.com account. And then you could still end up paying if you forget whether you ever signed up for Hulu or not (mayb…

A similar problem exists for weird services like Amazon that allow multiple accounts for the same email address (unless they finally fixed that stupid idea?).

Multiple accounts with the same email haven't been available for many, many years. I'm not sure exactly when registration for these was disabled, but it was 10+ years ago. Possibly 15-20 years ago.

I think it was a valid design decision at the time, before accounts on websites were widespread and a family might only have a single email address from their ISP.

The rise of free webmail accounts from Hotmail etc changed that, of course. And now we have a shared understanding of how accounts on websites should work. Neither of those were true in 1994.

Re: The dots do matter: how to scam a Gmail user

#148

Post by mulmen »

tass wrote: post #138
jimwhite wrote: post #35

100% disagree. My standard gmail address is with dots but when I have to tell my (rather long because it is my full three part name) I either omit the dots or tell them they don't matter. Totally an important and useful feature. Netflix is at fault for letting someone else use your email without asking you for permission.

Gmail could let you specify a list of valid addresses: first.mid.last, firstmidlast, firstmid.last Any others bounce or display the warning header suggested in the article.

That's exactly how it works today with the added benefit that the user does not have to enumerate the list and it's hard for other people to squat on slight variations to your email.

Re: The dots do matter: how to scam a Gmail user

#149

Post by _bxg1 »

I tentatively agree that it's an anti-feature and should be phased out, but the risk seems pretty small.

1) It can only be exploited on sites that don't verify email addresses, which is a relatively small number 2) In Netflix's case it's a pretty small "scam". $14 each month which you'd probably notice on your credit card history isn't going to break the bank. And presumably Netflix doesn't ever show a user's full credit card number, especially before email verification.

It's an interesting case, but I can't think of any bigger ways this could be exploited.

Re: The dots do matter: how to scam a Gmail user

#150

Post by Buge »

mulmen wrote: post #127
Buge wrote: post #17

Earlier quoted context omitted.

That same problem can happen even without dots. People can simply mistype their email and have it be your email. That happens if even if neither of you have dots in your email.

So then send the verification email at signup and any time the user changes the stored email on their account. Am I missing something?

I agree that's the answer. Unfortunately many services out there (including Netflix apparently) don't do that.
Post reply on HN