The dots do matter: how to scam a Gmail user

Post by uiri » Sat, Apr 07, 2018, 9:03 PM UTC

Pxtl wrote: post #164

mcpherrinm wrote: post #146

Earlier quoted context omitted.

Multiple accounts with the same email haven't been available for many, many years. I'm not sure exactly when registration for these was disabled, but it was 10+ years ago. Possibly 15-20 years ago. I think it was a valid design decision at the time, before accounts on websites were widespread and a family might only have a single email address from their ISP. The rise of free webmail accounts from Hotmail etc changed…

Good to know. I had accidentally created multiple accounts for myself around '05 or so and was really surprised by it. Iirc back then they also required separate accounts per-country, but I could be wrong about that.

Post by stordoff » Sat, Apr 07, 2018, 9:03 PM UTC

scott00 wrote: post #67

leoedin wrote: post #29

Why doesn't Netflix require users to be logged in before they can change their card details? That seems like the biggest security flaw, not the Gmail dot alias. (I'm guessing they did A/B testing and found that having to log into your account lost them some percentage of people. If that's the case, Netflix are clearly putting their retention rate ahead of security) There's probably a not insignificant number of peopl…

They do. The author reset the password to gain access.

Post by stordoff » Sat, Apr 07, 2018, 9:06 PM UTC

r00fus wrote: post #109

ada1981 wrote: post #50

I'm pretty sure Amazon allows unlimited accounts as long as you have different passwords. This is beyond bizarre. I have at least 2 accounts with the same email and the way into it is by knowing what password leads to which one. I have yet to see what happens if I try to set both accounts to the same password.

This is hard to believe. So you're saying that they hash/bcrypt (user+pass) to determine uniqueness?

Post by nebulous1 » Sat, Apr 07, 2018, 9:06 PM UTC

mulmen wrote: post #148

tass wrote: post #138

Earlier quoted context omitted.

Gmail could let you specify a list of valid addresses: first.mid.last, firstmidlast, firstmid.last Any others bounce or display the warning header suggested in the article.

That's exactly how it works today with the added benefit that the user does not have to enumerate the list and it's hard for other people to squat on slight variations to your email.

Post by fjsolwmv » Sat, Apr 07, 2018, 9:07 PM UTC

Santzes wrote: post #137

thephyber wrote: post #90

I don’t get the argument that the email dots stripping should be removed but the “+” tag feature should be kept. Both of them allow infinite email addresses. The tag feature is not always available because app developers frequently don’t allow the plus character. I would prefer that (1) a Netflix require email verification and (2) GMail describe in detail all of the email address features so app developers can explor…

My understanding is + sign is in the RFC, so of course it should be supported. If you want to identify your users by email, you should probably strip the + and everything after before checking for uniqueness. On the other hand, dots matter in the RFC and Gmail is breaking it with their "feature". edit: I was corrected in other comments that the + labeling is optional part of the standard.