Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The dots do matter: how to scam a Gmail user

jameshfisher.com

Post reply on HN
Print view View original

361–370 of 518 posts

Re: The dots do matter: how to scam a Gmail user

#361

Post by emodendroket »

uiri wrote: post #189
AndrewSnow wrote: post #42

Earlier quoted context omitted.

Absolutely. I don’t blame people who don’t interact with email for not reading the relevant RFCs, but not verifying control and expecting local part uniqueness to mean uniqueness of users is obviously busted to anyone who has worked with email. This is Netflix failing to understand part of their product surface. Both the dot behavior and the even more common ‘+’ feature are perfectly spec compliant.

It really bothers me the number of web services which reject email addresses containing '+' in the local part. If you're going to try to "validate" an email address, read the goddamn RFCs.

Someone definitely just copied a regex from StackOverflow (frankly if you actually look at the RFC a regex seems like a crazy approach).

Re: The dots do matter: how to scam a Gmail user

#362

Post by efficax »

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

Eh, but consider online shopping carts. I go to some ecommerce site, enter in my email to buy something. If I have to verify the email first, conversion rates will plummet. Instead, (and this is what we do at my company), we attempt to validate that the email is a real one with MX lookups and even SMTP checks. But otherwise, you just have to trust the shopper.

Re: The dots do matter: how to scam a Gmail user

#363

Post by efreak »

sorahn wrote: post #4

I really wish that I could tell google to bounce all the emails that don’t match my “dot pattern” I’m now in complete control of someone else’s commercial business hvac account because of precisely this problem. And the worse part is that I don’t know the correct email to get ahold of this person. They’ve set up library appointments, I received a receipt for a down payment on a lake house, basically most of this pers…

You may be able to set up filters to automatically trash everything sent to incorrect addresses. It might be fairly annoying, but it should certainly be possible. Just set a filter for firstlast@gmail.com to send them to spam. Also, software such as mailwatcher allows you to bounce emails after they've been received by the server if you think it necessary.

Re: The dots do matter: how to scam a Gmail user

#364

Post by __david__ »

ThoAppelsin wrote: post #336
pryce wrote: post #321

Earlier quoted context omitted.

Absolutely - his proposed solution - disabling the dots-dont-matter feature and retiring them does nothing to stop this exact same attack vector instead employing the '+' feature that he admires and wishes to retain. The attack goes like this: * Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher. * Eve creates a Netflix account w…

Perhaps Netflix people are to blame for taking +tagged mail addresses as different than the ones that are not tagged. It is a well-acknowledged [1] and commonly offered feature by the email providers that should have been accounted for. Dots-don't-matter, on the other hand, is very specific to Google, and they simply do matter in many other (if not all other) email providers. I think Netflix shouldn't be blamed for n…

The + thing is common but is absolutely not universal. I can alias individual + emails on my system just fine (which means that x+a@example.com and x+b@example.com are not equivalent) and most smtp servers allow you to set an alternate character (I set it to '.' and '_' so x.a@example.com and x_b@example.com are aliased together).

In short, Netflix cannot assume things after the '+' are irrelevant and Netflix absolutely cannot canonicalize random emails like that.

Re: The dots do matter: how to scam a Gmail user

#365

Post by ameliaquining »

rsync wrote: post #241
f2n wrote: post #229

Earlier quoted context omitted.

Try using an email address with .wedding or .solutions TLD. Loads of absolutely brain-dead sites refuse to allow them, sometimes they validate by TLD length (all TLDs are 2 or 3 characters, apparently) or other times rejection TLDs they haven't whitelisted.

"(all TLDs are 2 or 3 characters, apparently)" Which is odd, since there are some very, very old TLDs that are "long" ... I am thinking of .bitnet, .uucp and even the old .ussr[1] ... [1] "Initially, before two-letter ccTLDs became standard, the Soviet Union was to receive a .ussr domain." ( https://en.wikipedia.org/wiki/.su )

Those were never in widespread use in the email era. Anyone who knows about them is already technically sophisticated enough not to make this mistake.

Re: The dots do matter: how to scam a Gmail user

#366

Post by __david__ »

siimtalvik wrote: post #305
uiri wrote: post #189

Earlier quoted context omitted.

It really bothers me the number of web services which reject email addresses containing '+' in the local part. If you're going to try to "validate" an email address, read the goddamn RFCs.

One of the two reasons i changed my recipient_delimiter parameter to '.' The other would be that spammers know that anything after a + is usually optional and strip it. Can't do that when the delimiter is a '.'

I also did that, but I made '_' work, too. Part of me wants to add 'x' as an alternative just for further obfuscation.

Re: The dots do matter: how to scam a Gmail user

#367

Post by fvargas »

paxys wrote: post #346
fvargas wrote: post #288

The article shines light on three separate failures on Netflix's part: 1. Canonicalize email addresses Whether or not dots or +asdf is considered okay, an email address used for identification needs to be canonicalized in order to avoid duplicate sign-ups. 2. Never leak information through sign-up forms A login attempt either succeeds or fails. That is all the user should know. Telling the user if the attempted email…

Disagree with the first two. 1. Netflix shouldn't have to care about the internal implementation of Gmail addresses. It's perfectly fine to treat ab@service.com and a.b@service.com as separate accounts. 2. If you attempt to sign up for Netflix with an email address which already exists in their system and they tell you that, it isn't a security or privacy breach. There is absolutely no other way to handle the situati…

By canonicalization I'm not saying any arbitrary practice by Gmail or any other email provider should be considered as standard. I haven't looked at the RFC in some time, but I don't believe the use of plus suffixes is standard either. Nonetheless, I believe plus suffixes are more commonplace, generally permitted, and serve a reasonable purpose. For instance, sending email to a user using their email address as provided is a good practice in order to preserve a plus suffix which may aid the user in organizing their email. At the same time, canonicalizing email addresses in a sensible way, e.g. stripping plus suffixes, can be an aid for preventing unintentional, duplicate sign-ups. Just consider a sign-up form on the homepage of a website. It's not uncommon for people to enter their email and password into that form by mistake thinking they're signing in. Additionally, if the website compares canonical email addresses when checking login credentials, then a user who signed up with an email address containing a plus suffix can sign in using their base email. These two situations combined could lead to the accidental creation of a duplicate account if canonical email addresses are not compared during registration. There are some trade offs with this strategy, but as long as the canonicalization is implemented reasonably, I see it as an aid to the user. Note that reasonably doesn't necessarily mean stripping dots.

As for the second point, I consider it a privacy breach if a service publicly associates my email address with their service without my consent. Sign-up forms do this when giving different responses when an email address is registered vs not registered.

As for how to handle it, if a user signs up with a new email address, you send them an email to verify their email address and instruct them to check their email. Similarly, if a user attempts to sign up with an already registered email address, you send them an email letting them know they already have an account and instruct them to check their email, which will provide them with a link to login.

In the latter case, if they enter the correct password, you can just directly tell the user they already have an account, as they've proven their identity.

Re: The dots do matter: how to scam a Gmail user

#368

Post by __david__ »

ams6110 wrote: post #279
djur wrote: post #113

Earlier quoted context omitted.

Nope. RFC 5321: "the local-part MUST be interpreted and assigned semantics only by the host specified in the domain of the address". That means it's actually technically against the RFC to do any normalization of the local-part (like ignoring dots or case).

By that logic, jacksmith@example.com and johnjsmith@example.com could be delivered to the same mailbox. When I read TFA my first thought was "what does the standard say about it" and it does sound like Netflix is the one making the wrong assumption here. But I also see his point about how this can confuse users who don't realize this or are not using this behavior intentionally.

> By that logic, jacksmith@example.com and johnjsmith@example.com could be delivered to the same mailbox.

They absolutely could. Netflix can't assume they are or they aren't. Which means Netflix is doing the correct thing here. All they can know is that the emails are potentially different and so they should treat them as different emails.

Re: The dots do matter: how to scam a Gmail user

#369

Post by r00fus »

ada1981 wrote: post #171
r00fus wrote: post #109

Earlier quoted context omitted.

This is hard to believe. So you're saying that they hash/bcrypt (user+pass) to determine uniqueness?

I just took a screenshot of being logged into both accounts. https://imgur.com/a/jxmhI

How did you get the 2nd account in the first place? I'd like to reproduce this.

Re: The dots do matter: how to scam a Gmail user

#370

Post by jedberg »

BoorishBears wrote: post #300
jjeaff wrote: post #286

Earlier quoted context omitted.

I have a very short email address and get lots of these. What I do is immediately log in to the service and change the password. Then, if possible, I log out any other devices that are logged in. Then they can never access the account and continue to to use the service. Where available, I will delete the account as well. I found that if I don't do this, then I am just going to be receiving notification emails forever…

If this was me and it was happening often enough to be such a nuisance I had to hijack people’s accounts, I’d just get a different email. Mind you, I’m saying you should have to give up your email because other people have trouble spelling, just stating how I’d handle it.

I've had my gmail address for 14 years now (to the day actually). There is no way I'd give it up because of some morons.
Post reply on HN