Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The dots do matter: how to scam a Gmail user

jameshfisher.com

Post reply on HN
Print view View original

371–380 of 518 posts

Re: The dots do matter: how to scam a Gmail user

#371

Post by chii »

snarf21 wrote: post #248
thephyber wrote: post #90

I don’t get the argument that the email dots stripping should be removed but the “+” tag feature should be kept. Both of them allow infinite email addresses. The tag feature is not always available because app developers frequently don’t allow the plus character. I would prefer that (1) a Netflix require email verification and (2) GMail describe in detail all of the email address features so app developers can explor…

I must be missing something but the + and . feature both have the same problem for this "scam", right?

a dot looks way less suspicious to a non-technical user. a plus is more jarring, and more likely to incite suspicion.

Re: The dots do matter: how to scam a Gmail user

#372

Post by Camillo »

Removing the dots and the pluses is not enough.

Let's say that James Fisher also owns jameshfisher@yahoo.com. Eve finds that jameshfisher@gmail.com has a Netflix account, so she registers a new account with jameshfisher@yahoo.com. The scam proceeds the same way; if James registered for Netflix a while ago, he may not remember whether he registered with his Gmail address or with his Yahoo one (he has some services registered with the one, and some with the other). If he set up forwarding from his Yahoo account to his Gmail one, or if he's using a mail client, he may not even notice that the message went to a different address.

So the solution in this case is for Google to disallow registering jameshfisher@gmail.com if jameshfisher@yahoo.com already exists? Or to display phishing warnings on every email that was sent to a different address (and possibly forwarded)?

Maybe Netflix should simply verify the address upon registration after all.

Re: The dots do matter: how to scam a Gmail user

#373

Post by zachweisman »

Netflix probably deliberately ignores this loophole because it boosts subscribers and revenue.

I'd guess 25 million Netflix users use gmail accounts (~20% of 120M).

I'd guess 1 in 100 of those have been victims of this scam.

This would mean 250,000 victims are overpaying a cumulative $30M per year.

Given how popular gmail is, Netflix and others should disallow duplicate account where the only distinction is the dots. They should also force email verification within 30 days of signup.

Re: The dots do matter: how to scam a Gmail user

#374

Post by __david__ »

Pxtl wrote: post #104

I have multiple "e-mail doppelgangers" - confused people who don't know their own email address and so accidentally use my address when they register stuff. One's in Chile. I have almost no knowledge of Spanish. The other is in California. Having experienced this: Services need to email new email accounts they become aware of ASAP. They have literally zero UI available to me to notify them that this is an invalid ema…

It's funny, saying "email doppelgangers" reminded me that I have the same issue with phones and physical addresses (but not email since I use a unique domain name).

I get multiple snail mail bills for DirecTv to people with different names but my address. One of them apparently didn't pay, so now I'm also getting collections letters addressed to them at my address.

I've also had someone in Oregon use my google voice number at some doctor's clinic, so I was getting voice mail transcriptions about appointments and certain tests that needed to be run.

Turns out lots of people just can't figure out their own unique ids, whether they're email, phone, or home address.

Re: The dots do matter: how to scam a Gmail user

#375

Post by __david__ »

fvargas wrote: post #367
paxys wrote: post #346

Earlier quoted context omitted.

Disagree with the first two. 1. Netflix shouldn't have to care about the internal implementation of Gmail addresses. It's perfectly fine to treat ab@service.com and a.b@service.com as separate accounts. 2. If you attempt to sign up for Netflix with an email address which already exists in their system and they tell you that, it isn't a security or privacy breach. There is absolutely no other way to handle the situati…

By canonicalization I'm not saying any arbitrary practice by Gmail or any other email provider should be considered as standard. I haven't looked at the RFC in some time, but I don't believe the use of plus suffixes is standard either. Nonetheless, I believe plus suffixes are more commonplace, generally permitted, and serve a reasonable purpose. For instance, sending email to a user using their email address as provi…

The problem with your canonicalization idea is that it doesn't work in all cases. Yes, it might work with gmail addresses, but there's no way that you can assume that "david+x@example.com" and "david+y@example.com" are actually the same mailbox. If you so assume that, then you've just broken you websites for users where that isn't the case.

Re: The dots do matter: how to scam a Gmail user

#376

Post by Splines »

pryce wrote: post #321
hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

Absolutely - his proposed solution - disabling the dots-dont-matter feature and retiring them does nothing to stop this exact same attack vector instead employing the '+' feature that he admires and wishes to retain. The attack goes like this: * Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher. * Eve creates a Netflix account w…

> Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher.

The bug is right here - you shouldn't be able to determine if a user account already exists.

If an account already exists:

- Logon shouldn't tell you that you have an account and the password was wrong

- Registration should send a "looks like you already have an account" email to the recipient with "maybe this wasn't you" warning, and the web form shouldn't indicate anything out of the ordinary.

- Password reset should say "if an account exists, we just sent it an email"

Re: The dots do matter: how to scam a Gmail user

#377

Post by Splines »

Pxtl wrote: post #104

I have multiple "e-mail doppelgangers" - confused people who don't know their own email address and so accidentally use my address when they register stuff. One's in Chile. I have almost no knowledge of Spanish. The other is in California. Having experienced this: Services need to email new email accounts they become aware of ASAP. They have literally zero UI available to me to notify them that this is an invalid ema…

> If you don't provide a way in the emails to say "that's not me", then I have no way to ever register for your service with my address.

This happened to me - someone registered an Uber account with my email address. So I password reset it and now I have an Uber account for no good reason.

Re: The dots do matter: how to scam a Gmail user

#378

Post by sankalp_sans »

Slightly off topic, but why Gmail built a feature of Dots Don't Matter is beyond me.

Might have been a happy accident for all I know, but it changes the behavior that people expect from emails, which IMO is a bit of an inconvenience for other systems that rely on uniqueness of email addresses.

Re: The dots do matter: how to scam a Gmail user

#379

Post by 0xCMP »

Avamander wrote: post #275
nebulous1 wrote: post #197

Earlier quoted context omitted.

That isn't how it works today. They do not display any warning, and you have to hover your name to see what address it was sent to.

The infuriating part is that one can't reply from the address it was sent to, only from the one that's primary.

Yes, in fact this is one of the more annoying parts of this feature. When you're doing a support thing you usually have to reply with the exact same email. In my Google Suite account I have many domains setup to a single account and often times a reply uses my main account instead of an alias+domain I've setup on the account which received the email.

Would be nice to be able to easily reply as any of those combinations and default to the one it was sent to (dots, +'s, and domain).

Re: The dots do matter: how to scam a Gmail user

#380

Post by sankalp_sans »

Splines wrote: post #376
pryce wrote: post #321

Earlier quoted context omitted.

Absolutely - his proposed solution - disabling the dots-dont-matter feature and retiring them does nothing to stop this exact same attack vector instead employing the '+' feature that he admires and wishes to retain. The attack goes like this: * Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher. * Eve creates a Netflix account w…

> Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher. The bug is right here - you shouldn't be able to determine if a user account already exists. If an account already exists: - Logon shouldn't tell you that you have an account and the password was wrong - Registration should send a "looks like you already have an account" email…

Fair warning. That does add a certain level (quite significant) of inconvenience to existing users though. But probably a happy trade-off for most people entrusted with protecting accounts.
Post reply on HN