Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The dots do matter: how to scam a Gmail user

jameshfisher.com

Post reply on HN
Print view View original

311–320 of 518 posts

Re: The dots do matter: how to scam a Gmail user

#311

Post by spc476 »

sandov wrote: post #242
ksk wrote: post #204

Earlier quoted context omitted.

The bug is in humans. Heck, I regularly come across people who think the case in an email address matters! While there is no bug in Gmail, that is irrelevant because you have to deal with the reality of how people use your product. Its basic engineering. Standards are simply a means for interoperability. In this case, the dots don't matter much for that goal.

The case in an email address does matter. Look it up.

RFC-5322 (the current standard for Internet Message Formats) in section 3.4.1 states, "... how address is used and how messages are transported to a particular host is covered in separate documents, such as [RFC5321]."

RFC-5321 states in section 2.3.11: ''The standard mailbox naming convention is defined to be "local-part@domain"; contemporary usage permits a much broader set of applications than simple "user names". Consequently, and due to a long history of problems when intermediate hosts have attempted to optimize transport by modifying them, the local-part MUST be interpreted and assigned semantics only by the host specified in the domain part of the address.'

Furthermore, it states in section 2.4: 'The local-part of a mailbox MUST BE treated as case sensitive. Therefore, SMTP implementations MUST take care to preserve the case of mailbox local-parts. In particular, for some hosts, the user "smith" is different from the user "Smith". However, exploiting the case sensitivity of mailbox local-parts impedes interoperability and is discouraged. Mailbox domains follow normal DNS rules and are hence not case sensitive.'

While you are pedantically correct, to me that reads, "don't try to change the case of the local portion of email addresses and apply no meaning to it." In other words, treat it "as-is" and assume nothing about it.

Re: The dots do matter: how to scam a Gmail user

#312

Post by spc476 »

quasarj wrote: post #196
Pxtl wrote: post #104

I have multiple "e-mail doppelgangers" - confused people who don't know their own email address and so accidentally use my address when they register stuff. One's in Chile. I have almost no knowledge of Spanish. The other is in California. Having experienced this: Services need to email new email accounts they become aware of ASAP. They have literally zero UI available to me to notify them that this is an invalid ema…

Yep, same here. I've got a "DJ" in the US, but also a guy in India. The Indian guy is always getting legal threats for not paying his phone bill.. I feel a bit bad that he's not even getting the emails, but I have no idea how to actually contact either of these people...

Reply to the sender then, saying they have the wrong email account. That's what I do and over time it cuts down on the incorrect email I get.

Re: The dots do matter: how to scam a Gmail user

#313

Post by ksk »

sandov wrote: post #242
ksk wrote: post #204

Earlier quoted context omitted.

The bug is in humans. Heck, I regularly come across people who think the case in an email address matters! While there is no bug in Gmail, that is irrelevant because you have to deal with the reality of how people use your product. Its basic engineering. Standards are simply a means for interoperability. In this case, the dots don't matter much for that goal.

The case in an email address does matter. Look it up.

Where does it matter? Can you give an example?

Re: The dots do matter: how to scam a Gmail user

#314

Post by wiradikusuma »

I disagree with the conclusion. I own the domain name sweet.id and it has catch-all email.

Apparently some people (all women so far) found my domain name cute, they use it to register services (usually Twitter).

Maybe they think "Email" field in the signup form akin to "Username", something you create instead of something you already have.

Re: The dots do matter: how to scam a Gmail user

#316

Post by jiveturkey »

Article is wrong in several ways. Like correcting someone's grammar, one should get the facts straight first. So many here have also got it wrong, so it's not super surprising but those posters here haven't gone and published a righteous article making wrong conclusions.

First, this is all on Netflix. Regardless of what any provider does, Netflix has to protect its own accounts and the obvious way to do that is to verify an email address before taking payment info. It could do that in a specific way (per-provider, understanding how gmail specifically treats addresses) but treating it in a generic way seem better and insulates them from changes to gmail or other providers.

Now, gmail certainly could do things that bring attention to the quirks of their own platform, but that doesn't take any of the onus off of Netflix or any other service to DTRT themselves.

The flaws in the article:

1. You cannot have an infinite number of addresses. per RFC 5321 par 4.5.3.1.1, only 64 chars are allowed in the mailbox name.

2. Further, unless the mailbox is quoted, eg "mailbox", then dots may not be at the beginning or the end, and consecutive dots are not allowed. (RFC 5322, par 3.4.1 and 3.2.3). The article doesn't mention the need for quoting in its description of "infinite" addressing. This is due to the use of dots to atomize the text around it, for domain name parsing. It happens to be used in the local-part for some reasons, I suppose because dot isn't otherwise allowed and they didn't want to create another named grammar item.

3. There is no requirement for plus or dot to be non-unique elements. RFC 5233 defines plus addressing, but this only applies to systems that care to treat the plus in this special way. There's no general requirement that foo+bar and foo+baz are both subaddresses of the foo mailbox; they could instead be 2 distinct addresses. The specific relevance is that Netflix should treat plus just like dot -- don't treat it specially.

Re: The dots do matter: how to scam a Gmail user

#317

Post by sabujp »

ctz wrote: post #7
hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

PayPal and eBay also don't validate email, not even before attaching a bank account or making a purchase.

i found out that ebay.in does not, iirc they do for US accounts or am i wrong?

Re: The dots do matter: how to scam a Gmail user

#318

Post by theclaw »

hv42 wrote: post #101
endorphone wrote: post #65

Earlier quoted context omitted.

I'm now in complete control of someone else’s commercial business hvac account because of precisely this problem. But that has absolutely nothing to do with the dots. Indeed, almost every comment about this has nothing to do with the dots, including the submission. Someone entered the wrong email address, and in the process got yours. It isn't like the dotted or undotted one is legitimately theirs -- it can't possibl…

I strongly disagree with the author as well. Netflix is not doing its job. But the scam described by the author works because he victim already has an account registered with their Gmail address. The warning could be a good idea also I wish the email address of both the recipient and emitter were shown in a better in Gmail.

But the author reset the scammer's password, denying them access to their fake account. The scam doesn't seem to work unless Netflix allows you to enter a new credit card number /without/ resetting the password of the scammer's account.

Re: The dots do matter: how to scam a Gmail user

#319

Post by jiveturkey »

Speaking of plus addressing, too bad gmail doesn't have a feature that automatically adds a label of the "detail part" of a plussed address, without having to create the label and a specific filter for it. That'd make it so much easier to create vendor-specific addresses.

1. ignore all mail coming to the base (no plus) address that isn't also whitelisted/greylisted (too bad gmail doesn't support greylisting)

2. give out foo+vendor to any vendor, or foo+date to throwaway time limited mail. now you can see how +vendor gets distributed and decide to block all such mail easily.

3. stop accepting the time-limited mail after some period. eg

  +2018     stop accepting after 2/2019
  +201803   stop accepting after 4/2018
  +20180407 stop accepting after 4/8/2018
boom, magic filters.

Re: The dots do matter: how to scam a Gmail user

#320

Post by sandov »

ksk wrote: post #313
sandov wrote: post #242

Earlier quoted context omitted.

The case in an email address does matter. Look it up.

Where does it matter? Can you give an example?

If I send an email to John@company.com instead of john@company.com and the server of company.com is configured to be case sensitive, then john will never see my email.
Post reply on HN