Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail accepts forged YouTube emails

john-millikin.com

Post reply on HN
Print view View original

21–30 of 101 posts

Re: Gmail accepts forged YouTube emails

#21

Post by josephcsible »

2000UltraDeluxe wrote: post #16
KennyBlanken wrote: post #11

Meanwhile, Gmail is obsessed with tagging messages I get from nearly every mailing list I'm on, including ones hosted by google groups , as spam. Even messages sent by a gmail user, to a google group. Outdoor groups? Spam. Technical mailing lists? Spam. Social group mailing lists? Spam. I have filters assigning these messages to labels. I have been on some of these lists for ten fucking years . I routinely go into my…

That's the consequence of machine learning and allowing people to mark stuff as spam. 80% of all spam reports I get are for legitimate mails. A surprisingly large amount of them are people who mark their own mails as spam.

I don't think this is why. In my experience, when this happens, it's universally because the message failed at least one of SPF, DKIM, or DMARC.

Re: Gmail accepts forged YouTube emails

#22

Post by geoduck14 »

tjpnz wrote: post #18
beders wrote: post #14

What would it take to rescue email? What would need to happen to make it less annoying for you?

I liked Bill Gates' idea of making senders pay a fee (perhaps a minimum amount specified by the recipient) and giving recipients the option of refunding it for personal contacts.

Ok. So. I'm not going to say that is a bad idea, but I will share a story.

I used to work for a company that was the USPS's #1 or #2 customer (depending on the year). We spent a TON of money on spam. The biggest cost was the stamp.

If people have to start paying for emails- it will eliminate a lot of the spam -but it won't eliminate all of the spam- and companies like the one I used to work for will start to shine.

Re: Gmail accepts forged YouTube emails

#23

Post by colbertw08 »

gouggoug wrote: post #20
jeffbee wrote: post #10

Earlier quoted context omitted.

Correct, this message isn't forged, it's authentic. You can check the signature yourself.

> Correct, this message isn't forged, it's authentic I personally receive a lot of emails that aren't addressed to me and aren't marked as spam and have always wondered how this works. Can someone go into a bit more details about why this works? In what way is this message authentic? The ARC wiki page says "Validating an ARC chain only makes sense if the receiver trusts the ARC signers."; in this case the receiver is…

Yes I would love to know why this works as well. I've noticed over the past few months, I get emails that land in my gmail inbox that are obviously spam (various bs offers), and I've always wondered how they are able to bypass the spam filter with ease it seems. Also the To email line is to an email address that is a variation of my email address @aol.com that doesn't actually exist

Re: Gmail accepts forged YouTube emails

#24

Post by [deleted] »

KennyBlanken wrote: post #11

Meanwhile, Gmail is obsessed with tagging messages I get from nearly every mailing list I'm on, including ones hosted by google groups , as spam. Even messages sent by a gmail user, to a google group. Outdoor groups? Spam. Technical mailing lists? Spam. Social group mailing lists? Spam. I have filters assigning these messages to labels. I have been on some of these lists for ten fucking years . I routinely go into my…

[deleted]

Re: Gmail accepts forged YouTube emails

#25

Post by theK »

josephcsible wrote: post #21
2000UltraDeluxe wrote: post #16

Earlier quoted context omitted.

That's the consequence of machine learning and allowing people to mark stuff as spam. 80% of all spam reports I get are for legitimate mails. A surprisingly large amount of them are people who mark their own mails as spam.

I don't think this is why. In my experience, when this happens, it's universally because the message failed at least one of SPF, DKIM, or DMARC.

While these factors can cause a quarantine or even silent disposal, empirical evidence suggests that there are custom mechanisms (ie spam filters) downstream that do the larger part of the filtering.

I have been running private Mail servers since the early 2000s and this last decade has certainly not been nice to folks that want to self host. I cannot even send my mother in law email because Google just plainly denies delivery with no way to circumvent. Funnily enough mass mailing from the same account 10000 other gmail addresses has delivery metrics just like doing it with mailchimp. I think it is safe to say that big email hosting has grown so complex internally that the companies themselves can’t really make sense of it any more.

Edit: to preempt possible “you are doing it wrong” comments, my Mail server setup checks out in every conceivable test suite and email content as well :-)

Re: Gmail accepts forged YouTube emails

#26

Post by XorNot »

colbertw08 wrote: post #23
gouggoug wrote: post #20

Earlier quoted context omitted.

> Correct, this message isn't forged, it's authentic I personally receive a lot of emails that aren't addressed to me and aren't marked as spam and have always wondered how this works. Can someone go into a bit more details about why this works? In what way is this message authentic? The ARC wiki page says "Validating an ARC chain only makes sense if the receiver trusts the ARC signers."; in this case the receiver is…

Yes I would love to know why this works as well. I've noticed over the past few months, I get emails that land in my gmail inbox that are obviously spam (various bs offers), and I've always wondered how they are able to bypass the spam filter with ease it seems. Also the To email line is to an email address that is a variation of my email address @aol.com that doesn't actually exist

The latest thing that started happening a week or two ago was an endless stream of unsolicited mailing list messages addressed to "Prunella" trying to get me to click on links. Ended up just setting up an autodelete when that name is in the Send field (because I discovered Gmail doesn't let you auto-spam folder things).

Re: Gmail accepts forged YouTube emails

#27

Post by donmcronald »

gouggoug wrote: post #20
jeffbee wrote: post #10

Earlier quoted context omitted.

Correct, this message isn't forged, it's authentic. You can check the signature yourself.

> Correct, this message isn't forged, it's authentic I personally receive a lot of emails that aren't addressed to me and aren't marked as spam and have always wondered how this works. Can someone go into a bit more details about why this works? In what way is this message authentic? The ARC wiki page says "Validating an ARC chain only makes sense if the receiver trusts the ARC signers."; in this case the receiver is…

I think it’s because YouTube.com is the original sender and it’s considered ok if the receiver trusts the signers. The problem IMO is that the receiver’s mail provider (ex: ms365) doesn’t know if the receiver trusts the signers when deciding to deliver messages.

I’ve seen bad actors flood mailboxes with forwarded mail to obfuscate malicious activity. For example, they send a forged message asking for banking info updates and flood the real address that’ll get the “ok done” reply which I assume is an attempt to delay discovery of the attack.

Re: Gmail accepts forged YouTube emails

#28

Post by kazinator »

> addressed to an address that isn't mine.

This is because John was the envelope recipient: the one named in the SMTP protocol "RCPT to:" command.

There are ways that a perfectly legitimate e-mail you receive night not mention any of your addresses in To: or Cc:.

E.g. you are subscribed to a mailing list and some new posting (not part of some discussion you are in) arrives. It might just be addressed as "To: whatever-mailing-list@example.com". You received it because the mailing list robot used your e-mail as the RCPT to: envelope address at the SMTP protocol level.

Re: Gmail accepts forged YouTube emails

#29

Post by toast0 »

beders wrote: post #14

What would it take to rescue email? What would need to happen to make it less annoying for you?

Ban Microsoft and Google from email to start (they both control an awful lot of email but actively undermine its usefulness). Death penalty for spammers (maybe three strikes, or 300% of revenue from spam + audit costs if you want to be really nice). Corporal punishment for inappropriate reply-all. Refuse HTML email.

Maybe some sort of nice and easy to use mailing list setups, so I can invite you to my family / friend / crazy internet people list, and I'll send a mail every once in a while and you can read about what's going on with your family / friends / crazy internet people in a nice text optimized way.

I'd also love someone to make server side filters that operate on read email or email left in inbox for 30 days. I want my mail to sit in a big mixed pile of garbage when it's newish, but after a while, settle into a decent taxonomy.

Re: Gmail accepts forged YouTube emails

#30

Post by jdnordy »

I received the same email, just from a different domain:

ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@seiroowebizexpo.com header.s=jb54 header.b="l0E4c/Ut"; dkim=pass header.i=@youtube.com header.s=20210112 header.b=xGMHx3cn; arc=pass (i=1 spf=pass spfdomain=scoutcamp.bounces.google.com dkim=pass dkdomain=youtube.com dmarc=pass fromdomain=youtube.com); spf=pass (google.com: domain of support@seiroowebizexpo.com designates 2a01:7c8:aab3:2dc::8 as permitted sender) smtp.mailfrom=support@seiroowebizexpo.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=youtube.com Return-Path: Received: from 8j.seiroowebizexpo.com (8j.seiroowebizexpo.com. [2a01:7c8:aab3:2dc::8])

Post reply on HN