Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail accepts forged YouTube emails

john-millikin.com

Post reply on HN
Print view View original

11–20 of 101 posts

Re: Gmail accepts forged YouTube emails

#11

Post by KennyBlanken »

Meanwhile, Gmail is obsessed with tagging messages I get from nearly every mailing list I'm on, including ones hosted by google groups, as spam. Even messages sent by a gmail user, to a google group.

Outdoor groups? Spam.

Technical mailing lists? Spam.

Social group mailing lists? Spam.

I have filters assigning these messages to labels.

I have been on some of these lists for ten fucking years.

I routinely go into my spam folder and find a dozen messages from these lists tagged as spam, dutifully click "not spam", and rinse/wash/repeat.

Rarely does spam make it into my inbox, but it's so much worse that messages I give a shit about are routinely dumped into my spam box. But not so routinely that I think to check it often enough...

Re: Gmail accepts forged YouTube emails

#12

Post by quickthrower2 »

actionablefiber wrote: post #2

Any ideas for why that email appeared in your inbox? It doesn't look like it's a phishing attack - "Updates to YouTube's Terms of Service" is a subject line that guarantees that precisely zero people will even bother opening it.

Close to zero, which is lots for a spammer.

Re: Gmail accepts forged YouTube emails

#13

Post by KennyBlanken »

ocdtrekkie wrote: post #7

On one hand, they aren't special casing their own products, so good on them I guess? On the other hand, if they can't detect this, what point is their spam filtering even? Public mail services can be surprisingly bad at what they decide not to catch. I love Fastmail but because some existing customers rely on it, the default behavior is not to block inbound emails with the same domain as you've delegated entirely to…

> One would expect a given provider should, unless instructed explicitly otherwise, block outside emails from domains it controls mail for.

It's not even something you need to specifically craft much infrastructure for. There are public standards for "don't accept email from this domain unless the sender has a cert encrypted by one of these CAs" (Google runs their own CA, yes?) and "don't accept email from this domain except from these servers" and so on.

Re: Gmail accepts forged YouTube emails

#15

Post by gjs278 »

KennyBlanken wrote: post #11

Meanwhile, Gmail is obsessed with tagging messages I get from nearly every mailing list I'm on, including ones hosted by google groups , as spam. Even messages sent by a gmail user, to a google group. Outdoor groups? Spam. Technical mailing lists? Spam. Social group mailing lists? Spam. I have filters assigning these messages to labels. I have been on some of these lists for ten fucking years . I routinely go into my…

No post body was provided.

Re: Gmail accepts forged YouTube emails

#16

Post by 2000UltraDeluxe »

KennyBlanken wrote: post #11

Meanwhile, Gmail is obsessed with tagging messages I get from nearly every mailing list I'm on, including ones hosted by google groups , as spam. Even messages sent by a gmail user, to a google group. Outdoor groups? Spam. Technical mailing lists? Spam. Social group mailing lists? Spam. I have filters assigning these messages to labels. I have been on some of these lists for ten fucking years . I routinely go into my…

That's the consequence of machine learning and allowing people to mark stuff as spam. 80% of all spam reports I get are for legitimate mails. A surprisingly large amount of them are people who mark their own mails as spam.

Re: Gmail accepts forged YouTube emails

#17

Post by usr1106 »

I have had the opposite problem for years. (Well, if it's a problem.) I have many Google accounts opened with disposable addresses, one for each service. (They are pretty old (10+ years) and to many of them I have lost access. I have the password, but Google does not let me in without providing a phone number first. Because I don't want to share my phone number every time I cannot register to any new Google services. But I guess that's only a good thing, the company has become too evil a long time ago.)

All addresses get forwarded to my "main" gmail. And since the beginning of times all updates of terms and whatnot go to spam. I believe for phishing, not even for similar messages have been recognized as spam before. I mark them as not spam every time, but their filter just doesn't learn.

Because I use disposable addresses everywhere I get very little spam. I close addresses that end up at a spammer. For me Gmail's filters produce at least 80% false positives. And marking messages as not spam seems to have little to no persistent impact.

Re: Gmail accepts forged YouTube emails

#18

Post by tjpnz »

beders wrote: post #14

What would it take to rescue email? What would need to happen to make it less annoying for you?

I liked Bill Gates' idea of making senders pay a fee (perhaps a minimum amount specified by the recipient) and giving recipients the option of refunding it for personal contacts.

Re: Gmail accepts forged YouTube emails

#19

Post by Agamus »

usr1106 wrote: post #17

I have had the opposite problem for years. (Well, if it's a problem.) I have many Google accounts opened with disposable addresses, one for each service. (They are pretty old (10+ years) and to many of them I have lost access. I have the password, but Google does not let me in without providing a phone number first. Because I don't want to share my phone number every time I cannot register to any new Google services.…

You have described my own situation rather precisely.

Re: Gmail accepts forged YouTube emails

#20

Post by gouggoug »

jeffbee wrote: post #10
RKearney wrote: post #6

The reason for this is right in the headers. The message had a valid ARC headers used to preserve DKIM/SPF/DMARC checks when forwarding email. https://en.wikipedia.org/wiki/Authenticated_Received_Chain

Correct, this message isn't forged, it's authentic. You can check the signature yourself.

> Correct, this message isn't forged, it's authentic

I personally receive a lot of emails that aren't addressed to me and aren't marked as spam and have always wondered how this works.

Can someone go into a bit more details about why this works? In what way is this message authentic?

The ARC wiki page says "Validating an ARC chain only makes sense if the receiver trusts the ARC signers."; in this case the receiver is Gmail. Why does gmail trust a random domain (robtoledoyour.com)?

Post reply on HN