Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The dots do matter: how to scam a Gmail user

jameshfisher.com

Post reply on HN
Print view View original

131–140 of 518 posts

Re: The dots do matter: how to scam a Gmail user

#131

Post by hibbelig »

djur wrote: post #113
nabla9 wrote: post #94

Earlier quoted context omitted.

Dot's don't matter if the relevant RFC says they don't matter and I think this is the case. Google follows the standard, Netflix does not.

Nope. RFC 5321: "the local-part MUST be interpreted and assigned semantics only by the host specified in the domain of the address". That means it's actually technically against the RFC to do any normalization of the local-part (like ignoring dots or case).

Well, google.com assigned semantics to the local-part, which they are allowed, even supposed, to do.

Re: The dots do matter: how to scam a Gmail user

#132

Post by Sir_Substance »

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

>This is Netflix's issue for not validating the email account.

Eeeh, I just re-read RFC 2822. It explicitly states that the local-part of an address may contain any number of dots as long as they are separated by (if I'm reading this correctly) at least one character, and do not start with a dot.

There's nothing in there that states you should treat dotted and undotted variants of an address as the same address.

So, google isn't violating the specification, but they are extending it in an unexpected way. Google could extend it further by implementing a "giraffes don't matter" policy where any instances of the word "giraffe" are recursively snipped out, so that "test@example.com" is the same as "tegirgiraffeaffest@example.com", but if they did it would be a bit rich for them to expect the rest of the world to adapt code to that decision.

It might be reasonable for google to expect others to handle this "dots dont matter" policy if it was some kind of defacto standard, but AFAIK it's not. I would argue that this form of attack is uniquely enabled by the gmail devs making a decision to add additional behavior to an otherwise well-understood spec, and that it's not netflixes problem to solve that.

To be frank, netflix can't solve it. Asking netflix to change their code will only solve it for netflix, gmail users will still be "at risk" from, you know, potentially literally every other domain on the internet.

So I would say that this is a risk that gmail users need to be aware of and mitigate themselves, perhaps by taking such drastic steps as reading their bills before paying them.

Re: The dots do matter: how to scam a Gmail user

#133

Post by tehwalrus »

Or, whenever you get an unexpected email, go retrieve your credentials from your password manager, log in via the main page, and check you can see the message/problem it's referring to.

(Some of us use the dots to trick some sites into using a nonstandard email, rather like the username+netflix@gmail trick, so you can see who sold your email to the viagra trolls. Some sites reject + in emails, making the dots v handy.)

Re: The dots do matter: how to scam a Gmail user

#134

Post by ada1981 »

r00fus wrote: post #109
ada1981 wrote: post #50

I'm pretty sure Amazon allows unlimited accounts as long as you have different passwords. This is beyond bizarre. I have at least 2 accounts with the same email and the way into it is by knowing what password leads to which one. I have yet to see what happens if I try to set both accounts to the same password.

This is hard to believe. So you're saying that they hash/bcrypt (user+pass) to determine uniqueness?

I have at least two accounts; same email; I have two passwords and sometimes I screw it up.

I'm trying to think of a simple way to screenshot / show this without leaking person info...

Re: The dots do matter: how to scam a Gmail user

#135

Post by djur »

sorahn wrote: post #47
ocdtrekkie wrote: post #9

Earlier quoted context omitted.

Do you also, by chance, have a short Gmail address? I've also definitely gotten signups from other individuals mistyping their address on my six letter account. My comedy ownership of someone else's identity is a Staples account. Presumably someone in New York with a similar name had a store person look up their Staples account, which was actually my Staples account, and associate their business name with it. Their b…

It’s not too short. 12 characters including the name separating dot. This person that recently started using this email is using the same name but with no dot. first.lastname@gmail is what I use, and now I’m getting a bunch for firstlastname@gmail. Some of these emails look pretty important too, if I had malicious intent, I could probably ruin and or steal this persons identity and or business with the specific mail…

Wouldn't the same thing be happening if they'd entered first.lastname@gmail, or if you used firstlastname@gmail? It seems like the problem is that they entered an email address that wasn't actually theirs. The dots don't seem to make a difference.

Re: The dots do matter: how to scam a Gmail user

#136

Post by notatoad »

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

I agree, the responsiblity for this flaw ultimately lies with netflix. And if laying blame is a helpful thing to do, the blame lies with netflix.

But at the same time, in a purely practical sense the mockup at the end of the article showing an explicit warning about email being sent to a non-canonical address is clearly excellent and should be implemented.

Re: The dots do matter: how to scam a Gmail user

#137

Post by Santzes »

thephyber wrote: post #90

I don’t get the argument that the email dots stripping should be removed but the “+” tag feature should be kept. Both of them allow infinite email addresses. The tag feature is not always available because app developers frequently don’t allow the plus character. I would prefer that (1) a Netflix require email verification and (2) GMail describe in detail all of the email address features so app developers can explor…

My understanding is + sign is in the RFC, so of course it should be supported. If you want to identify your users by email, you should probably strip the + and everything after before checking for uniqueness. On the other hand, dots matter in the RFC and Gmail is breaking it with their "feature".

edit: I was corrected in other comments that the + labeling is optional part of the standard.

Re: The dots do matter: how to scam a Gmail user

#138

Post by tass »

jimwhite wrote: post #35

100% disagree. My standard gmail address is with dots but when I have to tell my (rather long because it is my full three part name) I either omit the dots or tell them they don't matter. Totally an important and useful feature. Netflix is at fault for letting someone else use your email without asking you for permission.

Gmail could let you specify a list of valid addresses:

first.mid.last, firstmidlast, firstmid.last

Any others bounce or display the warning header suggested in the article.

Re: The dots do matter: how to scam a Gmail user

#139

Post by typicalbender »

dfee wrote: post #110
hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

I see a lot of claims that email addresses should be verified prior to a transactional email being delivered - that that’s the “norm” or stupidly obvious way. But when there is a real consequence on a conversion funnel for requiring email address verification (say ecommerce), I imagine the obvious business decision is to do the exact opposite.

It's about risk management. In this case they decided to take on the risk of account information leaking by not verifying the address instead of the risk to account conversions. The former shows more care toward their users and the latter shows more care to their bottom line. You can argue which is the right decision all day long but ultimately is a question of risk tolerance.

Re: The dots do matter: how to scam a Gmail user

#140

Post by mulmen »

dfee wrote: post #110
hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

I see a lot of claims that email addresses should be verified prior to a transactional email being delivered - that that’s the “norm” or stupidly obvious way. But when there is a real consequence on a conversion funnel for requiring email address verification (say ecommerce), I imagine the obvious business decision is to do the exact opposite.

What's the point of a conversion funnel that creates exactly one conversion and then a huge amount of customer grief when they can never use the account again?

If the email address matters then validate it, if it doesn't need to be validated then don't ask for it.

Post reply on HN