Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The dots do matter: how to scam a Gmail user

jameshfisher.com

Post reply on HN
Print view View original

231–240 of 518 posts

Re: The dots do matter: how to scam a Gmail user

#231

Post by sandov »

The article is wrong: The number of email addresses is NOT INFINITE.

The 'user' part of an email address (before the @) has a maximum length of 64 characters. If n is the number of non-dot characters in the user part, then only (64 - n) dots can be added to the address for it to still be valid.

The valid email addresses for that user are a subset of all 64 character combinations possible with dots, alphanumeric chars, _, and a finite set of characters that I don't remember right now. That is a finite set, therefore the subset is also finite.

Re: The dots do matter: how to scam a Gmail user

#232

Post by morelikeborelax »

Pxtl wrote: post #104

I have multiple "e-mail doppelgangers" - confused people who don't know their own email address and so accidentally use my address when they register stuff. One's in Chile. I have almost no knowledge of Spanish. The other is in California. Having experienced this: Services need to email new email accounts they become aware of ASAP. They have literally zero UI available to me to notify them that this is an invalid ema…

I have the same issue, except I have a 6 character nickname using 3 unique characters at gmail and people use it for all sorts. Games, flights, utility bills, shopping sites, phone contracts, dating sites and much more. From all over the world. I had someone else's dropbox too, and even after the continued warnings they would cancel it and had cancelled it there were messages to access it still, that it was still there with the ability to view data.

The strangest by far though is the huge amount of gmail accounts created with my email as the backup. I have to assume that wording on some localisations indicate you need one so they mash the keys and pop in my gmail.

So I have hundreds of security alerts for recovery and notifications it has been set.

Funny old world.

Re: The dots do matter: how to scam a Gmail user

#233

Post by colomon »

djur wrote: post #135
sorahn wrote: post #47

Earlier quoted context omitted.

It’s not too short. 12 characters including the name separating dot. This person that recently started using this email is using the same name but with no dot. first.lastname@gmail is what I use, and now I’m getting a bunch for firstlastname@gmail. Some of these emails look pretty important too, if I had malicious intent, I could probably ruin and or steal this persons identity and or business with the specific mail…

Wouldn't the same thing be happening if they'd entered first.lastname@gmail, or if you used firstlastname@gmail? It seems like the problem is that they entered an email address that wasn't actually theirs. The dots don't seem to make a difference.

Indeed, my wife gets this problem all the time on gmail because her name is a fairly common one. The dots don't enter into it in the general case.

Re: The dots do matter: how to scam a Gmail user

#234

Post by djur »

shkkmo wrote: post #226
djur wrote: post #212

Earlier quoted context omitted.

To be clear, I'm talking about what email providers could do to reduce the risk of confusion, not what email senders should do to validate emails. I agree that the only way to validate an email address is to send a confirmation.

Except it does little to nothing to reduce confusion. It does nothing to fix the problem of people signing up using an email with a typo or with an email that doesn't actually belong to them. This on service providers to implement secure access properly.

I'm not thinking primarily of transactional emails here. If Gmail allowed dots and allowed registering both "jane.smith" and "janesmith", Jane Smith would be well-advised to register both, because it's going to be the most common mistake people make. It's the same principle that suggests that if you own a .org address you should probably go ahead and buy the .com, too.

Re: The dots do matter: how to scam a Gmail user

#236

Post by ellisv »

I haven't had issues with the dot feature but have run into problems using plus.

My problem was that I used a "first.last+website@gmail.com" format when I signed up for a website and some time later I needed to contact customer support by e-mail. They had no record of my account because my e-mail came from "first.last@gmail.com" and not "first.last+website@gmail.com".

It turns out there is a way to send mail from "first.last+website@gmail.com" but I don't think it existed at the time.

Re: The dots do matter: how to scam a Gmail user

#237

Post by saagarjha »

sandov wrote: post #231

The article is wrong: The number of email addresses is NOT INFINITE. The 'user' part of an email address (before the @) has a maximum length of 64 characters. If n is the number of non-dot characters in the user part, then only (64 - n) dots can be added to the address for it to still be valid. The valid email addresses for that user are a subset of all 64 character combinations possible with dots, alphanumeric chars…

For Gmail, you can add a plus to the left side of your email address and then append an arbitrary string. For example, email@gmail.com and email+foo@gmail.com are the same address.

Re: The dots do matter: how to scam a Gmail user

#238

Post by sandov »

AndrewSnow wrote: post #42
hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

Absolutely. I don’t blame people who don’t interact with email for not reading the relevant RFCs, but not verifying control and expecting local part uniqueness to mean uniqueness of users is obviously busted to anyone who has worked with email. This is Netflix failing to understand part of their product surface. Both the dot behavior and the even more common ‘+’ feature are perfectly spec compliant.

No one's saying that they aren't spec compliant, the writer is complaining that google doesn't tell its users that their inbox will include emails for more than 1 address.

Re: The dots do matter: how to scam a Gmail user

#239

Post by rowyourboat »

ESRogs wrote: post #52
jamesfisher wrote: post #16

Earlier quoted context omitted.

I think these are orthogonal issues. The dots do matter, but Netflix should also validate email addresses. However, I don't think it's as critical. Lack of email validation means I receive someone else's ride details (I agree, annoying), but dots-don't-matter means I might accidentally pay for that person's rides.

If Google fixed dots-don't-matter, couldn't someone still sign up for Netflix with jameshfisher+netflix@gmail.com? If Netflix checks for + address duplicates, then that's not an issue. But you could still have the situation where someone signs up for, let's say, Hulu with your standard jameshfisher@gmail.com account. And then you could still end up paying if you forget whether you ever signed up for Hulu or not (mayb…

Right. The +-suffix suffers from the same problem as the dots-don't-matter-policy: While some implementations use + as a separator between a mailbox name and a suffix, there is nothing in the RFC that encodes that, so different server implementations could just as well see + as a regular letter of the local part. Netflix has no choice but to treat james.h.fisher@gmail.com, jameshfisher@gmail.com and jameshfisher+netflix@gmail com as different email addresses. Really, to the left of the @, almost anything goes, and how an MDA maps the local part to a specific mailbox is completely up to the implementer.

As you point out, the only way around this email verification.

Post reply on HN