11–20 of 51 posts
Wouldn't a similarly effective method be to script SMTP and see which ones get rejected as envelope to addresses?
This isn't an issue, you can do the same thing with the main login form and a number of undocumented APIs. I've never seen anyone else acknowledge "confirmation of email address existence" as a security issue and I don't see why Google should be the first.
It's usually called "username enumeration" and there's plenty of pen testing firms that include this as a standard part of their process.
Wouldn't a similarly effective method be to script SMTP and see which ones get rejected as envelope to addresses?
The problem is these sames sites have a self-signup, using a unique email as your login. So you can already find out if an email address is in use or not.
If you've going to 'leak' the data one way or another, dont sacrifice UX for the sake of it.
Wouldn't a similarly effective method be to script SMTP and see which ones get rejected as envelope to addresses?
No, google SMTP accepts the RCPT TO with 250 "I'll try my best" regardless of the existence of the email.
>RCPT TO:
550-5.1.1 The email account that you tried to reach does not exist. Please try
550-5.1.1 double-checking the recipient's email address for typos or
550-5.1.1 unnecessary spaces. Learn more at
550 5.1.1 https://support.google.com/mail/?p=NoSuchUser j63si2824869ybj.160 - gsmtp
>RCPT TO: RCPT TO:
250 2.1.5 OK j63si2824869ybj.160 - gsmtpEarlier quoted context omitted.
Nah, it's not a security bug, that means we can exploit it.
Makes me wonder what they require to classify the bug as a security bug. Perhaps it gets classified otherwise since there's no data leakage other than an address? The existence of an address isn't exactly confidential.
I'm going to have to agree with Google here, in that this isn't an exploitable security vulnerability. Knowing that the mailboxes famous.celebrity@gmail.com or controversial.journalist@gmail.com exist doesn't bring me any closer to exploiting the knowledge. I don't know that Famous Celebrity is in fact THE famous celebrity. I don't know whether Controversial Journalist still reads mail sent to that account. Most impo…
The OP found a way to discover 40000 new addresses of random people per day by brute forcing through a dictionary-generated list of plausible candidates.
Use it for Nigerian scams, Viagra ads, account hijacking, anything you please.
This isn't an issue, you can do the same thing with the main login form and a number of undocumented APIs. I've never seen anyone else acknowledge "confirmation of email address existence" as a security issue and I don't see why Google should be the first.
> I've never seen anyone else acknowledge "confirmation of email address existence" as a security issue It's usually called "username enumeration" and there's plenty of pen testing firms that include this as a standard part of their process.
I see companies trying to solve a similar issue on their password reset forms. They ask you to enter an email address - then give you a reply "if that email exists, we have sent a password reminder there". The problem is these sames sites have a self-signup, using a unique email as your login. So you can already find out if an email address is in use or not. If you've going to 'leak' the data one way or another, dont…