Using email for 30 years and TIL that dot's don't matter.
That's not a feature of e-mail. That's a feature of gmail. The dots do matter for many other e-mail providers.
The dots do matter: how to scam a Gmail user
461–470 of 518 posts
Re: The dots do matter: how to scam a Gmail user
#462There's a bit of a logic issue in the proposed attack. > 7. Change the email for the Netflix account to eve@gmail.com, kicking Jim’s access to this account. This assumes that Eve is 1) still logged into the session despite the fact that Jim has changed their password and 2) that Netflix does not require a user to provide the current account password to change the email. I have no idea if Netflix does item 1; it's deb…
If they don't do item 1, you could pull off the scam by just staying logged in to the same session forever.
Re: The dots do matter: how to scam a Gmail user
#463It's a user's problem. If user is willing to click through some unsolicited email and pay , he will probably click on the verification link too if the service would send those. It's still a statistics game. Not everyone would pay without verification and not everyone would click the big green button in the verification mail, but some people will without realizing what's up, just like people fall for Nigerian scams ma…
Lots of services send me legitimate e-mails asking me to update my credit card information. I'm supposed to click on those. They come from Netflix and all of the text in the e-mail tells me to click on them. I don't click on them because I don't trust links from e-mails, but I'm supposed to.
No service ever sends me account verification e-mails for existing accounts. I'm not supposed to click on those. The text in the e-mail has instructions about whether I should click on it. This makes it different from the credit card e-mail.
Re: The dots do matter: how to scam a Gmail user
#464> Actually, the blame lies with Gmail, and specifically Gmail’s “dots don’t matter” feature. Totally wrong. Dots don't matter is a great way to filter your messages without giving an obvious filter. An example... I used to use first.last+yourcompany@gmail.com when I shopped online. But a lot of companies started blocking addresses that contained a "+" as an invalid address. So now I use firstlast@gmail.com for genera…
You've explained why dots don't matter is a useful feature, but that has nothing to do with whether it's responsible for some security issues.
Re: The dots do matter: how to scam a Gmail user
#465Earlier quoted context omitted.
I really don't see why Netflix needs insider knowledge or whatever to be able to detect john.doe as being the same as johndoe.
I believe it’s because this feature is largely unique to Gmail? So Netflix would need to know and maintain a database of rules based on domains. * Gmail: Dots are cool. * Hotmail: No capes! I mean dots. No dots! * Multiplied by 8 hundred gazillion domains...
No database needed, just ask for e-mail validation by sending an account validation link to the e-mail. Problem mostly solved.
Re: The dots do matter: how to scam a Gmail user
#466It's a user's problem. If user is willing to click through some unsolicited email and pay , he will probably click on the verification link too if the service would send those. It's still a statistics game. Not everyone would pay without verification and not everyone would click the big green button in the verification mail, but some people will without realizing what's up, just like people fall for Nigerian scams ma…
Lots of services send me legitimate e-mails asking me to update my credit card information. I'm supposed to click on those. They come from Netflix and all of the text in the e-mail tells me to click on them. I don't click on them because I don't trust links from e-mails, but I'm supposed to. No service ever sends me account verification e-mails for existing accounts. I'm not supposed to click on those. The text in th…
You don't click because you're educated in these matters. Most people are not.
Re: The dots do matter: how to scam a Gmail user
#467Earlier quoted context omitted.
because if you know someone's email address you have now also discovered that they have an account with a particular service which you should not be able to do.
Furthermore, people reuse passwords. So of course there are a number of known-good login/password combination lists in the wild. As soon as you find a valid login, you can test all known passwords (plus variations) associated with it.
Can’t you do this anyway on the service? You are assuming there is no rate limiting and the passwords are used directly as bearer tokens to access the site.
But since you are giving advice to the DESIGNER of the site, why not simply tell them not to use passwords? https://qbix.com/blog for example
Re: The dots do matter: how to scam a Gmail user
#468Earlier quoted context omitted.
Upon entering a valid email (whether it is already registered or not) the form will show the following notification "an email was sent to user@email.com with the sign up instructions, please follow the link in the email to continue the registration" (rewrite for more concise message) If the user already exists the email will be a warning + a link to the password reset form If the user does not exist, the email will b…
And conversion drops right away. On every of my projects as soon as "auto sign in" was dropped -- conversion dropped as well. (assuming that the "conversion" is to make a user to register and do something afterwards) I know that there should be some kind of compromise since any security measure added to secure accounts will lead to some inconvenience for users. If your goal to make sign in process as smooth for users…
Many sites allow you to continue, but limit your account and nag you about verifying your email. This seems like more of a happy medium, if you're concerned about conversion.
Re: The dots do matter: how to scam a Gmail user
#469Earlier quoted context omitted.
I must be missing something but the + and . feature both have the same problem for this "scam", right?
a dot looks way less suspicious to a non-technical user. a plus is more jarring, and more likely to incite suspicion.
I'd say most "non-technical" users dont even look at the email address it was sent to. They just assume that since it landed in their inbox, the magic 'computer' knows what its doing and they just need to read their email and reply appropriately.
Re: The dots do matter: how to scam a Gmail user
#470It sounds like there are two security flaws:
1. No email verification upon account creation.
2. No sign in requirement when updating payment info (which seems absurd)