The dots do matter: how to scam a Gmail user • Hacker News Board

Re: The dots do matter: how to scam a Gmail user

#471

Post by gilbetron » Sun, Apr 08, 2018, 4:11 PM UTC

pryce wrote: post #321

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

Absolutely - his proposed solution - disabling the dots-dont-matter feature and retiring them does nothing to stop this exact same attack vector instead employing the '+' feature that he admires and wishes to retain. The attack goes like this: * Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher. * Eve creates a Netflix account w…

I don't understand - won't this process fail when the person signs up for "jameshfisher+netflix@gmail.com"? Netflix will send a confirmation email to the real jameshfisher@gmail.com, and not confirm it, and so Netflix won't create the account. Things stop at this point.

Re: The dots do matter: how to scam a Gmail user

#472

Post by chenning » Sun, Apr 08, 2018, 4:19 PM UTC

Netflix should validate the email account. But, also, when you get the email to update the invalid credit card information and you click on the link, shouldn't Netflix force you to Sign In? This kind of security step is already common to thwart attack vectors where someone finds your computer unlocked and tries to reset your password on you. Google does this when you go to accounts.google.com. They always verify it is you sitting in front of the computer. So getting back to the Netflix situation, once you click on the link to update your credit care info you won't know the password for the rogue account and it's not your account UUID or whatever so I'm assuming Netflix is smart enough to make you prove it's you by entering the password. But you won't know the password. If you were tempted to click Forgot Password and go through all that rigamarole, then you hijacked the attacker's account. I guess what I'm trying to say is, most of the issue here should already be solved by appropriate defenses against different types of attacks. No?

Re: The dots do matter: how to scam a Gmail user

#473

Post by [deleted] » Sun, Apr 08, 2018, 4:25 PM UTC

georgeam wrote: post #285

codetrotter wrote: post #82

Earlier quoted context omitted.

Thinking about this a bit more, I believe that there is another problem with how account creation is done. In general we do it in two steps: 1. User detail and password 2. E-mail confirmation Instead, if we did 1. User details but NOT password 2. E-mail confirmation and subsequently entering the password on the page that was sent via e-mail. Actually, I think the most optimal would be 1. Enter e-mail address only 2.…

Maybe I don't understand the second option, but it seems to me that if you do the second option and a wrong email address is provided in step 1, then in step 2, the wrong person can take ownership of the account and provide his own password. So I agree with codetrotter that the third option is best of the three, to protect the two people from each other. The possible disadvantage I see with the third option however i…

[deleted]

Re: The dots do matter: how to scam a Gmail user

#474

Post by frogperson » Sun, Apr 08, 2018, 4:39 PM UTC

jimwhite wrote: post #35

100% disagree. My standard gmail address is with dots but when I have to tell my (rather long because it is my full three part name) I either omit the dots or tell them they don't matter. Totally an important and useful feature. Netflix is at fault for letting someone else use your email without asking you for permission.

DONT do this. I own the dotless version of an email address like this. I constantly get email intended for some realtor in California that does this. I see so much paper work that I should never see.

Re: The dots do matter: how to scam a Gmail user

#475

Post by frogperson » Sun, Apr 08, 2018, 4:42 PM UTC

So the dotless version is essentially the catch all, and anyone using a dotted version is at risk of losing some email to the dotless account holder?

Re: The dots do matter: how to scam a Gmail user

#476

Post by s0rce » Sun, Apr 08, 2018, 5:19 PM UTC

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

I get these types of things nearly daily since everyone mistakenly assumes they have my gmail account, single first initial and common last name. Many services don't require you to confirm e-mails, this is the problem. My apple ID account was created by someone else and they set the security questions and if you "forget" all the answers you cannot reset them online!

Only services I've seen that handled this properly are gmail and snapchat which send a verification e-mail to the entered address (for gmail its the secondary) and there is a link that you can click indicating your e-mail should not be associated with this account.

Re: The dots do matter: how to scam a Gmail user

#477

Post by billsmithaustin » Sun, Apr 08, 2018, 5:24 PM UTC

Some guy from the UK uses my Gmail address all the time. I once received a British Airlines confirmation for him. After clicking on the link (no authentication required!), I arrived on a page where I could change his notification settings. His phone number was listed there, so I texted him asking that he stop using my email address. He replied back and sounded alarmed that I had his phone number.

I also received a photo of his passport once. Using that, a friend in the UK was able to look up his parent’s home address. I phoned them up and left a message asking that he stop using my email address.

He’s still using it, so I eventually set up a Gmail filter to shunt his likely emails into a separate folder. I’ve changed my password since all this happened, and I don’t get why he still uses my address.

Re: The dots do matter: how to scam a Gmail user

#478

Post by daveFNbuck » Sun, Apr 08, 2018, 5:33 PM UTC

written wrote: post #466

daveFNbuck wrote: post #463

Earlier quoted context omitted.

Lots of services send me legitimate e-mails asking me to update my credit card information. I'm supposed to click on those. They come from Netflix and all of the text in the e-mail tells me to click on them. I don't click on them because I don't trust links from e-mails, but I'm supposed to. No service ever sends me account verification e-mails for existing accounts. I'm not supposed to click on those. The text in th…

You don't click because you're educated in these matters. Most people are not.

Not clicking on the credit card update e-mail requires being educated in these matters. Not clicking on the account verification e-mail just requires reading the e-mail before clicking. I think that's an important distinction.

Re: The dots do matter: how to scam a Gmail user

#479

Post by bhartzer » Sun, Apr 08, 2018, 5:59 PM UTC

Exactly why I don't use a gmail email address for anything important (like my user accounts). Instead, logins for important accounts use my own domain name.

Re: The dots do matter: how to scam a Gmail user

#480

Post by grepthisab » Sun, Apr 08, 2018, 6:08 PM UTC

Note the link in the article to throwaway credit card number provider (and yc company) Final is no longer valid because Final is defunct. Well, the link works, but you can no longer sign up.