Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The dots do matter: how to scam a Gmail user

jameshfisher.com

Post reply on HN
Print view View original

421–430 of 518 posts

Re: The dots do matter: how to scam a Gmail user

#421

Post by drdaeman »

ThoAppelsin wrote: post #336
pryce wrote: post #321

Earlier quoted context omitted.

Absolutely - his proposed solution - disabling the dots-dont-matter feature and retiring them does nothing to stop this exact same attack vector instead employing the '+' feature that he admires and wishes to retain. The attack goes like this: * Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher. * Eve creates a Netflix account w…

Perhaps Netflix people are to blame for taking +tagged mail addresses as different than the ones that are not tagged. It is a well-acknowledged [1] and commonly offered feature by the email providers that should have been accounted for. Dots-don't-matter, on the other hand, is very specific to Google, and they simply do matter in many other (if not all other) email providers. I think Netflix shouldn't be blamed for n…

All of this would be still useless regarding the proposed attack concept, because eve@gmail.com is also eve@googlemail.com.

And domain aliasing is certainly out of scope of any email RFCs I saw. Netflix (and everyone else) may know about googlemail.com, but it's virtually impossible to know about all other cases.

Re: The dots do matter: how to scam a Gmail user

#422

Post by danjayh »

kevin_thibedeau wrote: post #334
pryce wrote: post #321

Earlier quoted context omitted.

Absolutely - his proposed solution - disabling the dots-dont-matter feature and retiring them does nothing to stop this exact same attack vector instead employing the '+' feature that he admires and wishes to retain. The attack goes like this: * Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher. * Eve creates a Netflix account w…

Moreover some broken email validators reject plus addresses. It's nice to be able to fall back on special dot combos when you want to keep track of sites selling your email to spammers.

Thank you.. I use this feature in exactly the same way. As I read,I was sitting there thinking "I can't possibly be the only one who knows about,uses,and likes this feature". Disabling it at this point would seriously screw up my life. It also prevents people from registering all of those close variations of my gmail address, which I also like.

Re: The dots do matter: how to scam a Gmail user

#423

Post by brisance »

Lazare wrote: post #401

> The dots do matter: how to scam a Gmail user The dots do not matter, this does not enable a scam, and 99% of people replying to this seem to have utterly missed the point. First off, let's be clear: The story is about someone who entered the wrong email. They should have entered "eve@foo.com" but actually entered (or later changed it to) "james@foo.com", which means that James got some emails from Netflix about Eve…

Are we reading the same article?

The author is writing about getting a Netflix account funded by causing Netflix to send an email to a Gmail account holder. For all intents and purposes this is a legitimate email originating from Netflix. It is not about someone surreptitiously transferring control of another person's Netflix account to himself.

Re: The dots do matter: how to scam a Gmail user

#424

Post by mekoka »

Many here don't see a window of attack, the reasoning being that if the (presumably) malicious user gives the wrong email address they lose access to the account. Same outcome if the password gets changed by the recipient of the message. I'd like to offer a glimpse as to a potentially alternate outlook. Maybe it doesn't even apply to this specific situation, it nonethelss has a general relevancy to this conversation.

As an alternative (and sometime supplement) to the regular email/password sign-in, social sign-in is increasingly popular (mainly with OpenID Connect aka Authentication with OAuth2.0). A clear realization by many that have implemented social sign-in has been the separation of concerns between "account management" and "authentication management", which has the natural and arguably convenient side-effect of connecting multiple identifiers to the same account. The way it's done is that registered users are offered the possibility to add alternate sign-in methods to their existing account (e.g. you registered with Google, now you can add Facebook, or email/password).

The multiple login channels feature when correctly implemented with only OpenID Connect is safe since the identifier verification step is always part of the flow. Chances that the owner of the account unwillingly adds a sign-in channel not under their control is slim.

Consider on the other hand a situation where an organization would attempt to offer the same feature with OpenID Connect and their own email/password flow. If they do the latter à la Netflix, that is without confirming that the user owns the claimed email, there's your exploit window.

Malicious user John registers the account using social login (lets say Facebook). He later adds email/password as a login method along with an invalid credit card, but he uses unsuspecting user Jane's email, much like it was done in the Netflix case. Jane receives a message and thinking that it's her account that needs updating she first changes her password as a precaution, before "correcting" her credit card info. All throughout never realizing that an additional social sign-in option is enabled (Facebook).

As previously said here by many, always validate that the user owns the address you're communicating or authenticating with.

Re: The dots do matter: how to scam a Gmail user

#425

Post by pttrpttrwttr »

pryce wrote: post #416
slx26 wrote: post #385

Earlier quoted context omitted.

Agree that many steps can be improved. In real live, though, it's not so difficult to guess/find someone who has Netflix, and also find their email. That's a really weak security requirement, security shouldn't depend at all on that part (it seems more relevant for privacy to me)

Further, it is trivial to picture an attack where through some other channel, the attacker already knows the email address of their target, and has the knowledge that this victim has a netflix account. If I only need these two pieces of information, neither of which is intended to be 'secret', then I might easily already have enough information to attempt this attack on (for example) my ex, or their new partner, or s…

I really don't see why Netflix needs insider knowledge or whatever to be able to detect john.doe as being the same as johndoe.

Re: The dots do matter: how to scam a Gmail user

#426

Post by avar »

written wrote: post #283
avar wrote: post #218

Earlier quoted context omitted.

Even things at the right side of the @ are up to the E-Mail server. You can send an E-mail to @gmail.com or @GMAIL.COM and Google could be routing it differently. It'll resolve the same in DNS, but what the user typed will be encoded in E-Mail headers, and you could route differently depending on whether it's upper-case, mixed-case or whatever.

Not true, domain part is case insensitive by the standard. Server can decide for non-standard behavior, but that would be foolish.

The domain being in any case for the purpose of delivery is part of the standard, but there's nothing I know if which would prohibit you from implementing local delivery and routing in any way you want once the mail is accepted.

Re: The dots do matter: how to scam a Gmail user

#427

Post by LeonidasXIV »

Cyberspy wrote: post #420
rickycook wrote: post #343

Earlier quoted context omitted.

you still have session cookies, because AFAIK netflix doesn’t log out all your devices when you reset your password (though i think there’s an option for that?) so you can still set the password and email back if you have the session cookie maybe?

In that case, he must have been logged into Eve's account before he received the email. How did that happen?

The parent comment means the scammer case who can set the password back because they are still logged in. Which might be feasible.

But I don't think a scam that relies on you resetting the password and not becoming suspicious is a bit of a stretch.

Re: The dots do matter: how to scam a Gmail user

#428

Post by laughinghan »

Lazare wrote: post #401

> The dots do matter: how to scam a Gmail user The dots do not matter, this does not enable a scam, and 99% of people replying to this seem to have utterly missed the point. First off, let's be clear: The story is about someone who entered the wrong email. They should have entered "eve@foo.com" but actually entered (or later changed it to) "james@foo.com", which means that James got some emails from Netflix about Eve…

> the issue which is about people giving out your address instead of their own when creating an account, which is the actual issue here.

If the other person had tried to use the author's email address written exactly the same as his existing Netflix account, Netflix wouldn't have let the other person create a new account, but would instead have made them log into the existing account. The fact that Netflix and Gmail don't have the same notion of "existing account" IS the key issue here.

> the proposed scam, if it works, only works because (allegedly) Netflix lets you change an account email without verifying that you know the current password

Well, Eve knows the account's password at the time she changes the account email, the article explicitly mentions this: "Eve has access to account N2 because she set its password when signing up".

But this does touch on an interesting point. If Netflix required him to enter his password before he could update the credit card from Eve's to his own, then to go through with it he'd have to reset the password, so even if he went through with it and double-paid at least Eve wouldn't be able to reap the benefit of a free Netflix account, which is at least a less severe security issue than the current situation.

Re: The dots do matter: how to scam a Gmail user

#429

Post by lagadu »

Pxtl wrote: post #104

I have multiple "e-mail doppelgangers" - confused people who don't know their own email address and so accidentally use my address when they register stuff. One's in Chile. I have almost no knowledge of Spanish. The other is in California. Having experienced this: Services need to email new email accounts they become aware of ASAP. They have literally zero UI available to me to notify them that this is an invalid ema…

One of my emails is a "one name" gmail address so I get a few of these fairly often. I've tried doing the good thing where possible and trying to get it changed by contacting the provider but I just gave up. If I get more than a couple of emails from any account, I just hijack it permanently; I've found that deleting the account will only lead to the offender recreating it.
Post reply on HN