Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The dots do matter: how to scam a Gmail user

jameshfisher.com

Post reply on HN
Print view View original

501–510 of 518 posts

Re: The dots do matter: how to scam a Gmail user

#501

Post by gcb0 »

aaossa wrote: post #13
gcb0 wrote: post #2

netflix security suck for not doing email confirmation and the ONLY email to be sent to the updated address being a billing one. and no, it should never "know about" the dot feature in gmail. that is working as intended all around. it's simply that netflix put user bounce rate metric in front of protecting users from scam. plain and simple.

IMO It's not Netflix fault, actually emails with dots in different positions should be different emails. Also, not sending a confirmation email is a common pattern now. Maybe an email about "you created an account :D" should be enough mitigation, but this is not their fault.

I am not even sure what you are replying to. I never said opposite of "actually emails with dots in different positions should be different emails". I also strongly think so. Netflix suck for not letting the owner of the email know an account is associated with it in a much better way.

Re: The dots do matter: how to scam a Gmail user

#502

Post by gcb0 »

Pxtl wrote: post #119
bad_user wrote: post #92

Earlier quoted context omitted.

> actually emails with dots in different positions should be different emails Don’t know from where this is coming from but there’s no such _should be_ rule, there never was. As a matter of fact an email server can have any aliasing setup it wants. FastMail for example does sub-domain aliasing, which is awesome because I can use an unique email address for any service I sign up to. Any email server or service worth i…

subdomain aliasing sounds way better than + aliasing. Too many sites block + aliasing.

> Too many sites block + aliasing.

You actually mean: Too many sites were coded by incompetent people and have broken input validation.

Re: The dots do matter: how to scam a Gmail user

#503

Post by gcb0 »

Pxtl wrote: post #72
aaossa wrote: post #13

Earlier quoted context omitted.

IMO It's not Netflix fault, actually emails with dots in different positions should be different emails. Also, not sending a confirmation email is a common pattern now. Maybe an email about "you created an account :D" should be enough mitigation, but this is not their fault.

As somebody who has multiple people who aren't me registering accounts to variations of my email address: Companies who do not send "you've created an account! Click here if you didn't!" emails can die in a fire.

Ironically, the most i get of those emails is google itself

They allow any idiot to register my gmail address as their "alternative recovery email" without confirmation. And then from time to time i get a dozen "recover your account" emails from those accounts.

Re: The dots do matter: how to scam a Gmail user

#504

Post by bad_user »

gcb0 wrote: post #502
Pxtl wrote: post #119

Earlier quoted context omitted.

subdomain aliasing sounds way better than + aliasing. Too many sites block + aliasing.

> Too many sites block + aliasing. You actually mean: Too many sites were coded by incompetent people and have broken input validation.

Yes, unfortunately that's the truth.

For example: meetup.com

On an email with a plus in it, they complain with this exact error message: "This isn't a valid email address".

I contacted their support a year ago. They replied that they've passed along my "feedback". Nothing happened since then.

That said, plus aliasing is sort of a standard. And spammers could eliminate anything after the plus, its usage being pretty obvious, so you can't rely on it for tracing spam. Eliminating the aliasing is much trickier to do with sub-domains, as it's not at all clear when aliasing is used or not. And some email services support custom email routing based on your own regular expressions (e.g. GSuite) so you can come up with your own weird scheme.

Plus aliasing is only fine when you don't have control for doing something better, more opaque. Like when you have a work or a @gmail.com address.

Re: The dots do matter: how to scam a Gmail user

#505

Post by ZoFreX »

EGreg wrote: post #405
spinsser wrote: post #390

Earlier quoted context omitted.

Upon entering a valid email (whether it is already registered or not) the form will show the following notification "an email was sent to user@email.com with the sign up instructions, please follow the link in the email to continue the registration" (rewrite for more concise message) If the user already exists the email will be a warning + a link to the password reset form If the user does not exist, the email will b…

Why is it bad to know if an email is already registered?

It's not, necessarily.

It's a tradeoff between usability and security, and each site should make their own decision about what is right for them.

It obviously makes attacks like the one in the article easier, but there are other ways to mitigate that.

An example often given for when revealing an email is registered would definitely be bad is dating website and pornography websites - where identifying someone is a member alone could be embarrassing or compromising.

Outside of such scenarios, websites may decide the increased conversion from a more streamlined registration process and lower numbers of support requests for login issues outweigh the marginal security gains from hiding that information.

Re: The dots do matter: how to scam a Gmail user

#506

Post by DougWebb »

fyi1183 wrote: post #396
DougWebb wrote: post #266

Earlier quoted context omitted.

Typically when I implement user self-registration for my portal-website clients, I use a variation of your third option: 1. Enter email address and some out-of-band information that only an existing-account-holder should know. Eg: a web portal for a utility company could ask for the account number and amount due from a recent bill. 2. Send confirmation email with a code/link. 3. After user enters a valid code, contin…

Please don't use recovery Q&A. As a user, I cannot trust that a website gets the recovery flow right. Some websites will allow you to bypass email and password if you know the answer to the question. Because of that, I cannot put in the real answer, as that would be a massive security risk. So I usually put in some random garbage, which means it's essentially a second password. Well, if I lost my first password, chan…

Fair points, and I'm not a fan of the recovery Q&A either. But here's the process that I use:

1. User must enter their email address, and I send them an email with a recovery code.

2. After they enter the code, validating control of the email address, I show them the Question they chose and let them enter the answer.

3. After they enter the correct answer, I force them to update their password, and I send a confirmation email about the password update.

The emails all provide contact information and ask the user to get in touch if they didn't initiate any of these actions.

You're right about the answer being essentially a second password, and I treat it as such: only an encrypted hash is stored, type=password fields are used to enter it.

One of my clients did request getting rid of the Q&A, which I was able to do pretty easily because email verification step and reset code were already implemented.

On a personal note, I never use real answers for security questions. I use randomly generated strings, just like my passwords. If I can choose my own question I use a random string for that too.

Re: The dots do matter: how to scam a Gmail user

#507

Post by Gigablah »

astura wrote: post #483
Gigablah wrote: post #437

Earlier quoted context omitted.

If gmail ignores dots in the email address, of course that email is going to show up in your inbox.

And if it shows up it someone else's inbox then you know that the other person registered a gmail account with the dots, which was the question.

Which goes back to my question; how did he know that there is another inbox? Unless he happens to know the other person... well, in person.

And if he knows them in person, why hasn't either of them switched email addresses already (within the last 10 years)? Something doesn't add up here.

Re: The dots do matter: how to scam a Gmail user

#508

Post by jpcosta »

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

I really wish this was the norm!

I have a very common name and signed up for gmail address right at the start. I now receive tons of spam because there are people who sign up to the weirdest things with my gmail handle.

Re: The dots do matter: how to scam a Gmail user

#509

Post by B1FF_PSUVM »

cestith wrote: post #111
B1FF_PSUVM wrote: post #99

Earlier quoted context omitted.

The other way around. It's Google who decided to do it that way.

Which the RFCs for email do allow. The local part is the local part, under local control, and should not be assumed about by remote systems.

Regular people, upon looking at an email address, might think that

- alert@example.com

- A.Lert@example.com

- Al.Ert@example.com

etc. were different.

Requiring them to know or check what's the "local control" policy at each site may be a stretch.

Principle of least surprise, etc.

Re: The dots do matter: how to scam a Gmail user

#510

Post by tspike »

srazzaque wrote: post #442
tspike wrote: post #394

Earlier quoted context omitted.

I recently decided to ditch Gmail because I don't trust Google any more than Facebook. One nice side effect of this is that now that I'm using my own domain, all company signups can be to me@spam.domain.com, which is much harder to filter well.

I use my own domain, but still use Google for my email service. I've had fleeting thoughts of moving away, but am pretty used to the Google's spam filtering, labelling, search, and not having to care about space or managing my own kit. Are you DIY'ing everything?

Like dkersten, I moved to Fastmail. I used to DIY it but got tired of maintenance.
Post reply on HN