Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The dots do matter: how to scam a Gmail user

jameshfisher.com

Post reply on HN
Print view View original

341–350 of 518 posts

Re: The dots do matter: how to scam a Gmail user

#341

Post by jamesrcole »

joedj wrote: post #335
jamesrcole wrote: post #277

Earlier quoted context omitted.

I agree there's that fundamental problem with the way email gets handled. But at the same time I still wish Gmail would stop you from receiving emails on addresses other than the one you created yourself (ie by treating dots like any other character). It'd save me from getting several misdirected emails per day. It's true that all these misdirected emails come down to people misremembering their addresses, but I thin…

I do this, using a Google Apps script to send any emails to unexpected addresses to Spam. Something like this: https://stackoverflow.com/questions/24540743/how-to-spam-fil...

I have a concern with that. Say I train the filter to treat emails from company X as spam, and then in the future I sign up with company X and their emails to me get treated as spam.

I dont know for sure if that's how the filter would behave, though.

Re: The dots do matter: how to scam a Gmail user

#343

Post by rickycook »

theclaw wrote: post #308
kbsletten wrote: post #292

Earlier quoted context omitted.

He said in the post that he was able to reset the password because the account was linked to "his" email.

But if you have to reset the password to update the credit card details, then surely the scam won't work because the scammer would no longer be able to use the account. For this scam to work the "Update your credit card" mail must contain a credential that allows you to update the scammer's card without changing or being challenged for their password. That doesn't seem great.

you still have session cookies, because AFAIK netflix doesn’t log out all your devices when you reset your password (though i think there’s an option for that?) so you can still set the password and email back if you have the session cookie maybe?

Re: The dots do matter: how to scam a Gmail user

#344

Post by dahidahi1 »

Oh my god. This is quite a hurried at conclusion that the "dots-do-not-matter" is a misfeature of Gmail. This feature has prevented so many instances of spam that I cannot count them. Of course, I love the "+spam@gmail.com" feature as well, but I can't use that as often because most email field validations prevent the "+" character in email addresses.

Re: The dots do matter: how to scam a Gmail user

#345

Post by thrill »

written wrote: post #283
avar wrote: post #218

Earlier quoted context omitted.

Even things at the right side of the @ are up to the E-Mail server. You can send an E-mail to @gmail.com or @GMAIL.COM and Google could be routing it differently. It'll resolve the same in DNS, but what the user typed will be encoded in E-Mail headers, and you could route differently depending on whether it's upper-case, mixed-case or whatever.

Not true, domain part is case insensitive by the standard. Server can decide for non-standard behavior, but that would be foolish.

The name part, per the standard, is case sensitive. However, some organizations I get email from canonicalize it to all caps - and one even removes the dots(!) and all-cap it, which for my gmail I have a filter that sends all non-dotted email to spam, since 90% of my spam is non-dotted. Since that particular email was important and I'd just happened to notice it in spam, I checked the capitalization change and called them and even managed to get through to speak with their email manager. He absolutely insisted I was wrong about it mattering and said they wouldn't change it.

Re: The dots do matter: how to scam a Gmail user

#346

Post by paxys »

fvargas wrote: post #288

The article shines light on three separate failures on Netflix's part: 1. Canonicalize email addresses Whether or not dots or +asdf is considered okay, an email address used for identification needs to be canonicalized in order to avoid duplicate sign-ups. 2. Never leak information through sign-up forms A login attempt either succeeds or fails. That is all the user should know. Telling the user if the attempted email…

Disagree with the first two.

1. Netflix shouldn't have to care about the internal implementation of Gmail addresses. It's perfectly fine to treat ab@service.com and a.b@service.com as separate accounts.

2. If you attempt to sign up for Netflix with an email address which already exists in their system and they tell you that, it isn't a security or privacy breach. There is absolutely no other way to handle the situation.

Agree with the third one though. A "click here to activate" email absolutely needs to be standard in every sign-up flow.

Re: The dots do matter: how to scam a Gmail user

#347

Post by jdhawk »

kevin_thibedeau wrote: post #334
pryce wrote: post #321

Earlier quoted context omitted.

Absolutely - his proposed solution - disabling the dots-dont-matter feature and retiring them does nothing to stop this exact same attack vector instead employing the '+' feature that he admires and wishes to retain. The attack goes like this: * Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher. * Eve creates a Netflix account w…

Moreover some broken email validators reject plus addresses. It's nice to be able to fall back on special dot combos when you want to keep track of sites selling your email to spammers.

Spammers already know the dot rules. Its fairly easy to identify a Domain Group (ymail/yahoo) or (google/gmail/somewhere.edu) and then strip and reapply certain rules based on what that Mail Provider allows.

Re: The dots do matter: how to scam a Gmail user

#348

Post by Gigablah »

esdott wrote: post #330

The real kicker here though is that it IS possible to have registered a separate email address in gmail with a dot. My wife has been dealing with this in the opposite, she has a valid first.last@gmail and another person has a separate firstlast@gmail. She has the dot but frequently gets emails for the non dot address. We’ve gotten to know the person over like 10 years. If we’re victims of some sort of con game, then…

But how do you know that the other person registered a gmail account, as opposed to, say, them registering the wrong email address with the email senders?

Re: The dots do matter: how to scam a Gmail user

#349

Post by Lazare »

There's a bit of a logic issue in the proposed attack.

> 7. Change the email for the Netflix account to eve@gmail.com, kicking Jim’s access to this account.

This assumes that Eve is 1) still logged into the session despite the fact that Jim has changed their password and 2) that Netflix does not require a user to provide the current account password to change the email.

I have no idea if Netflix does item 1; it's debatable, although it might be a good idea in some cases. But item 2 is a super basic security; I can't imagine they don't do that. And if they do that, then there's no real attack here.

Re: The dots do matter: how to scam a Gmail user

#350

Post by pishpash »

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

These companies are stupid and not worthy of respect. Not only Netflix, but Apple and even some banks don't (or didn't) verify email before sending private information.
Post reply on HN