The dots do matter: how to scam a Gmail user • Hacker News Board

Re: The dots do matter: how to scam a Gmail user

#211

Post by stordoff » Sat, Apr 07, 2018, 9:17 PM UTC

IncRnd wrote: post #155

The two security issues are user phishing and Netflix not performing canonicalization of email addresses. he signup process itself is not a security issue. The issue from the perspective of the user should be that the author clicked on a link in an html email, when he should have instead gone to Netflix.com. He clicked first and only then checked. Gmail even warned him of the phishing possibility, and he still clicke…

> Gmail even warned him of the phishing possibility

Where are you seeing this? I see no warning in the screen shot.

> Netflix not performing canonicalization of email addresses

AFAICT, Netflix CAN'T canonicalise the email address (unless they start making assumptions about specific providers) -- according to the RFCs, they can be different email addresses.

Re: The dots do matter: how to scam a Gmail user

#212

Post by djur » Sat, Apr 07, 2018, 9:21 PM UTC

shkkmo wrote: post #177

djur wrote: post #122

Earlier quoted context omitted.

Permitting separate "sarah.jones" and "sarahjones" accounts would be pretty bad, too. Too easy to impersonate people. "Dots matter but are not included in uniqueness checks" is probably the safest approach.

While you CAN strip periods in the local part of the email and convert them to lower case before checking uniqueness, you do this as the risk of improperly disallowing valid and distinct addresses. A better solution is to check for similar address and provide a prompt "do you already have an account with this address:" rather than completely blocking registration with that address. However, you should definitely not…

To be clear, I'm talking about what email providers could do to reduce the risk of confusion, not what email senders should do to validate emails. I agree that the only way to validate an email address is to send a confirmation.

Re: The dots do matter: how to scam a Gmail user

#213

Post by tough_luck » Sat, Apr 07, 2018, 9:22 PM UTC

Pxtl wrote: post #164

mcpherrinm wrote: post #146

Earlier quoted context omitted.

Multiple accounts with the same email haven't been available for many, many years. I'm not sure exactly when registration for these was disabled, but it was 10+ years ago. Possibly 15-20 years ago. I think it was a valid design decision at the time, before accounts on websites were widespread and a family might only have a single email address from their ISP. The rise of free webmail accounts from Hotmail etc changed…

Good to know. I had accidentally created multiple accounts for myself around '05 or so and was really surprised by it. Iirc back then they also required separate accounts per-country, but I could be wrong about that.

I have same account (same mail) with amazon that works across their .com, .in, .fr., .co.uk

Re: The dots do matter: how to scam a Gmail user

#214

Post by shkkmo » Sat, Apr 07, 2018, 9:22 PM UTC

jamesfisher wrote: post #21

Buge wrote: post #11

>Where is the security flaw here? Some would say it’s Netflix’s fault; that Netflix should verify the email address on sign up, or that Netflix should disallow the registration of james.hfisher@gmail.com when a Netflix account already existed for jameshfisher@gmail.com. But such policies would not add security, and would force Netflix and every other website to have insider knowledge of Gmail’s canonicalization algor…

I'm sorry, this sentence wasn't clear, and I agree with you. What I meant by this was: - Some would say that Netflix should verify the email address on sign up, but there's no obvious attack that this mitigates. Using someone else's address on signup only cedes account control to them. - Others would say that Netflix should disallow the registration of james.hfisher@gmail.com when a Netflix account already existed fo…

> but there's no obvious attack that this mitigates

Anyone who owns fmail.com hmail.com gmil.com gmai.com can easily steal account details an personal information from people who have a typo when entering their email address if you don't verify the email address before sending that personal information.

If you are not verifying an email address before sending sensitive content or allowing an account to access sensitive information, you are doing security wrong.

edit: typo spelling typo...

Re: The dots do matter: how to scam a Gmail user

#215

Post by shkkmo » Sat, Apr 07, 2018, 9:24 PM UTC

ipsin wrote: post #24

melvinmt wrote: post #6

> But firstly, no one wants this infinite set of email addresses. Gmail already provides this in the better form of plus labelling. What is the difference between dots and pluses? They both have the same flaw: to Netflix they will both be distinct addresses.

Maaaany email address validators will reject Gmail addresses with + in them as "not valid". "Read the Friendly Standard", I know, but dots are much less likely to be rejected. Half the time I think it's because the site wants it to be less obvious when their database is compromised.

Authorize.net just started rejecting emails with + signs in them, causing transactions to start failing for many businesses.

https://community.developer.authorize.net/t5/Integration-and...

Re: The dots do matter: how to scam a Gmail user

#216

Post by scrame » Sat, Apr 07, 2018, 9:25 PM UTC

mcpherrinm wrote: post #146

Pxtl wrote: post #114

Earlier quoted context omitted.

A similar problem exists for weird services like Amazon that allow multiple accounts for the same email address (unless they finally fixed that stupid idea?).

Multiple accounts with the same email haven't been available for many, many years. I'm not sure exactly when registration for these was disabled, but it was 10+ years ago. Possibly 15-20 years ago. I think it was a valid design decision at the time, before accounts on websites were widespread and a family might only have a single email address from their ISP. The rise of free webmail accounts from Hotmail etc changed…

Naw, I left about 10 years ago and out was still there, and still had co-workers at a different job asking me about it a couple years later, because they got bit by it.

The justification I heard was that someone would have a personal and business (or library) account to the same email, but it definitely persisted longer than you think.

Re: The dots do matter: how to scam a Gmail user

#217

Post by bonercow » Sat, Apr 07, 2018, 9:25 PM UTC

ipsin wrote: post #30

ahmedalsudani wrote: post #23

Earlier quoted context omitted.

As far as I know, plus wildcards are not part of the standard either.

This is an RFC 5233 subaddress.

You're full of shit. The word "subaddress" doesn't occur anywhere in RFC 5233. The only thing RFC 5233 says about + in email addresses is that it's an allowable character.

Re: The dots do matter: how to scam a Gmail user

#218

Post by avar » Sat, Apr 07, 2018, 9:25 PM UTC

eric_h wrote: post #173

AndrewSnow wrote: post #42

Earlier quoted context omitted.

Absolutely. I don’t blame people who don’t interact with email for not reading the relevant RFCs, but not verifying control and expecting local part uniqueness to mean uniqueness of users is obviously busted to anyone who has worked with email. This is Netflix failing to understand part of their product surface. Both the dot behavior and the even more common ‘+’ feature are perfectly spec compliant.

I was under the impression that literally anything goes on the left side of the @. It’s all up to the individual mail server

Even things at the right side of the @ are up to the E-Mail server. You can send an E-mail to @gmail.com or @GMAIL.COM and Google could be routing it differently.

It'll resolve the same in DNS, but what the user typed will be encoded in E-Mail headers, and you could route differently depending on whether it's upper-case, mixed-case or whatever.

Re: The dots do matter: how to scam a Gmail user

#219

Post by shkkmo » Sat, Apr 07, 2018, 9:26 PM UTC

Buge wrote: post #36

richrichardsson wrote: post #15

Earlier quoted context omitted.

Pluses are part of email standard, dots are some nonsense Google thought was a good idea.

Plusses are an optional part of a standard[1]. The main email standard does not require a+b@c.com to be treated the same as a@c.com [2]. [1] https://tools.ietf.org/html/rfc5233 [2] https://tools.ietf.org/html/rfc5322#section-3.2.3

The use of pluses for tagging/subaddressing is an optional part of the standard. + being valid in an email address is not an optional part of the standard.

Re: The dots do matter: how to scam a Gmail user

#220

Post by coredog64 » Sat, Apr 07, 2018, 9:26 PM UTC

shkkmo wrote: post #177

djur wrote: post #122

Earlier quoted context omitted.

Permitting separate "sarah.jones" and "sarahjones" accounts would be pretty bad, too. Too easy to impersonate people. "Dots matter but are not included in uniqueness checks" is probably the safest approach.

While you CAN strip periods in the local part of the email and convert them to lower case before checking uniqueness, you do this as the risk of improperly disallowing valid and distinct addresses. A better solution is to check for similar address and provide a prompt "do you already have an account with this address:" rather than completely blocking registration with that address. However, you should definitely not…

Gmail is a fairly common mail host. Doing what you suggest for ‘@gmail.com’ addresses would be an easy solution.

You could also make the case that Google should have a free library for most common languages that does this for you. It would improve the safety of their users immensely.

I may, however, be somewhat biased as I am the frequent recipient of email from weird services that some other chucklehead keeps signing up for even though he has yet to get past email verification as he doesn’t own the address.