The dots do matter: how to scam a Gmail user • Hacker News Board

Re: The dots do matter: how to scam a Gmail user

#11

Post by Buge » Sat, Apr 07, 2018, 7:10 PM UTC

>Where is the security flaw here? Some would say it’s Netflix’s fault; that Netflix should verify the email address on sign up, or that Netflix should disallow the registration of james.hfisher@gmail.com when a Netflix account already existed for jameshfisher@gmail.com. But such policies would not add security, and would force Netflix and every other website to have insider knowledge of Gmail’s canonicalization algorithm.

This is a bizarre quote. The fact that "Netflix should verify the email address on sign up" would not "force Netflix and every other website to have insider knowledge of Gmail’s canonicalization algorithm".

Re: The dots do matter: how to scam a Gmail user

#12

Post by sofayam » Sat, Apr 07, 2018, 7:10 PM UTC

Interestingly Gmail will let you filter in a dot sensitive way. Anyone missing my dot gets sent to a folder called “wrongguy”. Whenever I drop by to look at it it’s full of spam.

Re: The dots do matter: how to scam a Gmail user

#13

Post by aaossa » Sat, Apr 07, 2018, 7:11 PM UTC

gcb0 wrote: post #2

netflix security suck for not doing email confirmation and the ONLY email to be sent to the updated address being a billing one. and no, it should never "know about" the dot feature in gmail. that is working as intended all around. it's simply that netflix put user bounce rate metric in front of protecting users from scam. plain and simple.

IMO It's not Netflix fault, actually emails with dots in different positions should be different emails. Also, not sending a confirmation email is a common pattern now. Maybe an email about "you created an account :D" should be enough mitigation, but this is not their fault.

Re: The dots do matter: how to scam a Gmail user

#14

Post by theptip » Sat, Apr 07, 2018, 7:11 PM UTC

melvinmt wrote: post #6

> But firstly, no one wants this infinite set of email addresses. Gmail already provides this in the better form of plus labelling. What is the difference between dots and pluses? They both have the same flaw: to Netflix they will both be distinct addresses.

It's easy to accidentally type "bob.foo" instead of "bobfoo", and it's also easy to miss the difference if you're the recipient of a malicious attack.

It's harder to accidentally type "bobfoo+abc", and it's harder to miss the difference if you're on the receiving end.

Re: The dots do matter: how to scam a Gmail user

#15

Post by richrichardsson » Sat, Apr 07, 2018, 7:12 PM UTC

melvinmt wrote: post #6

> But firstly, no one wants this infinite set of email addresses. Gmail already provides this in the better form of plus labelling. What is the difference between dots and pluses? They both have the same flaw: to Netflix they will both be distinct addresses.

Pluses are part of email standard, dots are some nonsense Google thought was a good idea.

Re: The dots do matter: how to scam a Gmail user

#16

Post by jamesfisher » Sat, Apr 07, 2018, 7:12 PM UTC

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

I think these are orthogonal issues. The dots do matter, but Netflix should also validate email addresses. However, I don't think it's as critical. Lack of email validation means I receive someone else's ride details (I agree, annoying), but dots-don't-matter means I might accidentally pay for that person's rides.

Re: The dots do matter: how to scam a Gmail user

#17

Post by Buge » Sat, Apr 07, 2018, 7:13 PM UTC

sorahn wrote: post #4

I really wish that I could tell google to bounce all the emails that don’t match my “dot pattern” I’m now in complete control of someone else’s commercial business hvac account because of precisely this problem. And the worse part is that I don’t know the correct email to get ahold of this person. They’ve set up library appointments, I received a receipt for a down payment on a lake house, basically most of this pers…

That same problem can happen even without dots. People can simply mistype their email and have it be your email. That happens if even if neither of you have dots in your email.

Re: The dots do matter: how to scam a Gmail user

#18

Post by tehlike » Sat, Apr 07, 2018, 7:13 PM UTC

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

I assume lots of emails get validated like this by people who doesn't know what they are doing.

Sad, really...

Re: The dots do matter: how to scam a Gmail user

#19

Post by dr4g0n » Sat, Apr 07, 2018, 7:15 PM UTC

I have a similar problem due to the whole "gmail.com" vs. "googlemail.com" thing that came about in Europe in the earlier days of Gmail.

When I got my gmail account, Google gave me a "googlemail.com" address, due to a pre-existing trademark in Europe. These days the "gmail.com" suffix works for my account, but I've already set everything up with the "googlemail.com" form and saw no reason to switch. Sometime in 2016, someone started using the "gmail.com" version to sign up for stuff, and I repeatedly nearly fell for this exact problem... It's made more difficult by the fact that Google clearly _want_ me to use the "gmail.com" form, and refer to it by that address in many places, despite me opting to use the long form in settings.

I don't think the person using my email address is being malicious, I think it's by mistake, but I have no means to contact him to fix the problem.

Re: The dots do matter: how to scam a Gmail user

#20

Post by Buge » Sat, Apr 07, 2018, 7:15 PM UTC

theptip wrote: post #14

melvinmt wrote: post #6

> But firstly, no one wants this infinite set of email addresses. Gmail already provides this in the better form of plus labelling. What is the difference between dots and pluses? They both have the same flaw: to Netflix they will both be distinct addresses.

It's easy to accidentally type "bob.foo" instead of "bobfoo", and it's also easy to miss the difference if you're the recipient of a malicious attack. It's harder to accidentally type "bobfoo+abc", and it's harder to miss the difference if you're on the receiving end.

>It's easy to accidentally type "bob.foo" instead of "bobfoo"

If someone made that typo (for a gmail address) everything would be fine, because both emails would go to the same correct person. There needs to be some additional typo for it to go to a different person.