Gmail has all sorts of bugs or had. I had used to get a lot of email addressed to someone else. These were genuine email - when I forwarded them to the intended recipient (basically resend to the "to" address) I got responses from people thinking I am a hacker or being stunned why would I get their email. After that I decided to just ignore those emails, especially that I haven't got response from Google. These had in common that they didn't use gmail domain. It was long time ago and I don't think I got any of those recently.
The dots do matter: how to scam a Gmail user
221–230 of 518 posts
Re: The dots do matter: how to scam a Gmail user
#222I'm pretty sure Amazon allows unlimited accounts as long as you have different passwords. This is beyond bizarre. I have at least 2 accounts with the same email and the way into it is by knowing what password leads to which one. I have yet to see what happens if I try to set both accounts to the same password.
They used to allow this, but AFAIK they don't anymore. I don't believe you'd be able to sign up a new account with that same email, and if you changed the email address on one, you wouldn't be able to change it back.
Source: I used to work at Amazon, though never on any systems that would be directly involved in this.
Re: The dots do matter: how to scam a Gmail user
#223Earlier quoted context omitted.
Absolutely. I don’t blame people who don’t interact with email for not reading the relevant RFCs, but not verifying control and expecting local part uniqueness to mean uniqueness of users is obviously busted to anyone who has worked with email. This is Netflix failing to understand part of their product surface. Both the dot behavior and the even more common ‘+’ feature are perfectly spec compliant.
It really bothers me the number of web services which reject email addresses containing '+' in the local part. If you're going to try to "validate" an email address, read the goddamn RFCs.
I like the idea of adding +spam@gmail.com, but it would be really easy for this to be invalidated by just stripping this from your email before selling it in a mailing list.
Re: The dots do matter: how to scam a Gmail user
#224> But firstly, no one wants this infinite set of email addresses.
Fuck off, that is my favorite feature.
Re: The dots do matter: how to scam a Gmail user
#225On the subject of reading someone else emails:
When a company that I worked for went under, I managed to catch their falling domain name. I setup catch-all which was mostly boring emails of ex emps Fecabook notifications and some bills etc, BUT the emails for the owners and few top execs were very interesting. In that sense that 3 years later I decided to build exactly the same business (well, one of a few)
Now it is running mostly on autopilot with $2.5MM annul revenue. Many times it obviously is what you don't know that is stopping you from entering the market. Everything I learnt by reading my ex bosses emails in few years allowed me to setup somewhat successful business, all on the side.
Re: The dots do matter: how to scam a Gmail user
#226Earlier quoted context omitted.
While you CAN strip periods in the local part of the email and convert them to lower case before checking uniqueness, you do this as the risk of improperly disallowing valid and distinct addresses. A better solution is to check for similar address and provide a prompt "do you already have an account with this address:" rather than completely blocking registration with that address. However, you should definitely not…
To be clear, I'm talking about what email providers could do to reduce the risk of confusion, not what email senders should do to validate emails. I agree that the only way to validate an email address is to send a confirmation.
Except it does little to nothing to reduce confusion. It does nothing to fix the problem of people signing up using an email with a typo or with an email that doesn't actually belong to them.
This on service providers to implement secure access properly.
Re: The dots do matter: how to scam a Gmail user
#227Earlier quoted context omitted.
Nope. RFC 5321: "the local-part MUST be interpreted and assigned semantics only by the host specified in the domain of the address". That means it's actually technically against the RFC to do any normalization of the local-part (like ignoring dots or case).
Doesn't that support what Google is doing? Google is the host specified in the domain, and they are interpreting the local-part to refer to the same mailbox if they only differ by dots. The RFC also notes that the local-part MAY be case-sensitive (i.e. it's up to the host). Edit: the host SHOULD ignore case: "a host that expects to receive mail SHOULD avoid defining mailboxes where [...] Local-part is case-sensitive"…
It does. The relevant RFC says they don't have to matter and that senders shouldn't assume they do or don't. That means that both Google and Netflix are following the standard. The problem isn't with either company's compliance with the RFC, but that's not saying a lot. A mail provider could legally ignore all vowels in mailbox names.
(Similarly, although the RFC does say hosts shouldn't have case-sensitive local-parts, it doesn't say that senders can assume that local-parts are case-insensitive.)
Re: The dots do matter: how to scam a Gmail user
#228Earlier quoted context omitted.
While you CAN strip periods in the local part of the email and convert them to lower case before checking uniqueness, you do this as the risk of improperly disallowing valid and distinct addresses. A better solution is to check for similar address and provide a prompt "do you already have an account with this address:" rather than completely blocking registration with that address. However, you should definitely not…
Gmail is a fairly common mail host. Doing what you suggest for ‘@gmail.com’ addresses would be an easy solution. You could also make the case that Google should have a free library for most common languages that does this for you. It would improve the safety of their users immensely. I may, however, be somewhat biased as I am the frequent recipient of email from weird services that some other chucklehead keeps signin…
> You could also make the case that Google should have a free library for most common languages that does this for you. It would improve the safety of their users immensely.
Please don't. I don't want an official library to exist to facilitate people harvesting and selling my email address without me knowing the source of the leak.
> I may, however, be somewhat biased as I am the frequent recipient of email from weird services that some other chucklehead keeps signing up for even though he has yet to get past email verification as he doesn’t own the address.
And you have existing accounts with all of these services? Or how does this relate to service providers striping dots when checking uniqueness?
You should report those emails as spam. If you never verified the email address they have no right to continue to send emails to you.
Re: The dots do matter: how to scam a Gmail user
#229Earlier quoted context omitted.
Absolutely. I don’t blame people who don’t interact with email for not reading the relevant RFCs, but not verifying control and expecting local part uniqueness to mean uniqueness of users is obviously busted to anyone who has worked with email. This is Netflix failing to understand part of their product surface. Both the dot behavior and the even more common ‘+’ feature are perfectly spec compliant.
It really bothers me the number of web services which reject email addresses containing '+' in the local part. If you're going to try to "validate" an email address, read the goddamn RFCs.
Try using an email address with .wedding or .solutions TLD. Loads of absolutely brain-dead sites refuse to allow them, sometimes they validate by TLD length (all TLDs are 2 or 3 characters, apparently) or other times rejection TLDs they haven't whitelisted.
Re: The dots do matter: how to scam a Gmail user
#230Earlier quoted context omitted.
My understanding is that the RFCs define how the Internet work so by definition, they are not wrong. You're certainly free to assert that they made a bad decision and I'm not qualified to offer an opinion on whether you are right or wrong. However since Netflix is not managing email addresses in accordance with RFC-5322 They are clearly wrong.
> However since Netflix is not managing email addresses in accordance with RFC-5322 They are clearly wrong. Where are they not?
I was wrong. I cannot find any information that indicates that the RFC specifies that the period is not significant, only that it is allowed. In this case I suppose it is Google that is wrong.