Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The dots do matter: how to scam a Gmail user

jameshfisher.com

Post reply on HN
Print view View original

381–390 of 518 posts

Re: The dots do matter: how to scam a Gmail user

#381

Post by zbentley »

tajen wrote: post #253
AndrewSnow wrote: post #182

Earlier quoted context omitted.

IIRC, not quite literally, but pretty close. The email RFCs in general tend to be much less constrained than one might expect.

Yup. Even spaces are allowed if you put double quotes around the local part: “Kevin Spacey”@example.com. It’s really surprising, there’s very little that can be verified if you strictly follow the RFC.

> there’s very little that can be verified if you strictly follow the RFC.

That's not correct. You can reliably, completely validate all email addresses . . . by sending an email to them containing information that can be used to confirm the owner's identity. All together now: the MTA is the only source of "is it valid or not" for email addresses.

Re: The dots do matter: how to scam a Gmail user

#383

Post by fvargas »

__david__ wrote: post #375
fvargas wrote: post #367

Earlier quoted context omitted.

By canonicalization I'm not saying any arbitrary practice by Gmail or any other email provider should be considered as standard. I haven't looked at the RFC in some time, but I don't believe the use of plus suffixes is standard either. Nonetheless, I believe plus suffixes are more commonplace, generally permitted, and serve a reasonable purpose. For instance, sending email to a user using their email address as provi…

The problem with your canonicalization idea is that it doesn't work in all cases. Yes, it might work with gmail addresses, but there's no way that you can assume that "david+x@example.com" and "david+y@example.com" are actually the same mailbox. If you so assume that, then you've just broken you websites for users where that isn't the case.

Why would you broadly assume an incorrect rule? Email address parsers correctly implement canonicalization rules that consider the domain e.g. gmail. It doesn't require any extra work as a developer and the logic is hidden behind the abstraction. But certainly, you shouldn't go implementing arbitrary rules that aren't reasonably applicable.

Re: The dots do matter: how to scam a Gmail user

#384

Post by saagarjha »

tejasmanohar wrote: post #251
saagarjha wrote: post #237

Earlier quoted context omitted.

For Gmail, you can add a plus to the left side of your email address and then append an arbitrary string. For example, email@gmail.com and email+foo@gmail.com are the same address.

And, it's still finite, right? Just a large, finite number :P

No? You can put whatever string you want there, of which there are an infinite number…

Re: The dots do matter: how to scam a Gmail user

#385

Post by slx26 »

Splines wrote: post #376
pryce wrote: post #321

Earlier quoted context omitted.

Absolutely - his proposed solution - disabling the dots-dont-matter feature and retiring them does nothing to stop this exact same attack vector instead employing the '+' feature that he admires and wishes to retain. The attack goes like this: * Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher. * Eve creates a Netflix account w…

> Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher. The bug is right here - you shouldn't be able to determine if a user account already exists. If an account already exists: - Logon shouldn't tell you that you have an account and the password was wrong - Registration should send a "looks like you already have an account" email…

Agree that many steps can be improved. In real live, though, it's not so difficult to guess/find someone who has Netflix, and also find their email. That's a really weak security requirement, security shouldn't depend at all on that part (it seems more relevant for privacy to me)

Re: The dots do matter: how to scam a Gmail user

#386

Post by hanspeter »

Splines wrote: post #376
pryce wrote: post #321

Earlier quoted context omitted.

Absolutely - his proposed solution - disabling the dots-dont-matter feature and retiring them does nothing to stop this exact same attack vector instead employing the '+' feature that he admires and wishes to retain. The attack goes like this: * Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher. * Eve creates a Netflix account w…

> Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher. The bug is right here - you shouldn't be able to determine if a user account already exists. If an account already exists: - Logon shouldn't tell you that you have an account and the password was wrong - Registration should send a "looks like you already have an account" email…

> the web form shouldn't indicate anything out of the ordinary

How will the user know that the registration failed and what to do about it?

Re: The dots do matter: how to scam a Gmail user

#387

Post by Too »

sandov wrote: post #320
ksk wrote: post #313

Earlier quoted context omitted.

Where does it matter? Can you give an example?

If I send an email to John@company.com instead of john@company.com and the server of company.com is configured to be case sensitive, then john will never see my email.

It is allowed to matter per the rfc. However I believe 99% of all mail servers in the world are configured to make it non case sensitive.

Re: The dots do matter: how to scam a Gmail user

#388

Post by adarshaj »

jdhawk wrote: post #347
kevin_thibedeau wrote: post #334

Earlier quoted context omitted.

Moreover some broken email validators reject plus addresses. It's nice to be able to fall back on special dot combos when you want to keep track of sites selling your email to spammers.

Spammers already know the dot rules. Its fairly easy to identify a Domain Group (ymail/yahoo) or (google/gmail/somewhere.edu) and then strip and reapply certain rules based on what that Mail Provider allows.

That's true in theory. In practice however, I've had success with figuring out a service that leaked my dotted address (I used a dot because the service didn't validate email with plus). I think this is often the case too because, spammers don't really bother validating emails by postprocessing etc. and just sell the emails in bulk in shady markets

Re: The dots do matter: how to scam a Gmail user

#389

Post by fphhotchips »

tbabb wrote: post #290
hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

Not only that, but apparently he was able to change Eve's account details without having to enter a password. If instead Netflix had prompted him before allowing him to change the credit card, it would not have worked, because he wouldn't have known Eve's password and Eve wouldn't have known his. All around very bad security design on Netflix's part.

I think this is the bingo. The scam doesn't work if you don't treat "access to email" as the sole authentication mechanism.

Re: The dots do matter: how to scam a Gmail user

#390

Post by spinsser »

hanspeter wrote: post #386
Splines wrote: post #376

Earlier quoted context omitted.

> Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher. The bug is right here - you shouldn't be able to determine if a user account already exists. If an account already exists: - Logon shouldn't tell you that you have an account and the password was wrong - Registration should send a "looks like you already have an account" email…

> the web form shouldn't indicate anything out of the ordinary How will the user know that the registration failed and what to do about it?

Upon entering a valid email (whether it is already registered or not) the form will show the following notification "an email was sent to user@email.com with the sign up instructions, please follow the link in the email to continue the registration" (rewrite for more concise message)

If the user already exists the email will be a warning + a link to the password reset form

If the user does not exist, the email will be a link that confirms the ownership of the email address and the rest of the registration process.

An attacker trying to guess if an email is registered would not know, because the form does not give away that info.

Post reply on HN