Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My account is sending spam emails

productforums.google.com

Post reply on HN
Print view View original

141–150 of 154 posts

Re: My account is sending spam emails

#141

Post by archon810 »

teddyh wrote: post #132
sethvargo wrote: post #129

Earlier quoted context omitted.

1. I am a human. I promise :) 2. I apologize if my response came off as “PR speak” as that was not my intention. 3. I am trying to manage customer concerns. It’s why I’m responding on HackerNews and similar sites.

> I am trying to manage customer concerns You do that by providing actual information , not by corporate zero-information talk.

You do realize he has to run the information he can and cannot give out by his higher-ups and possibly legal before he can reply publicly, right? Google isn't a small operation and is very vulnerable to lawsuits.

Also it's a Sunday.

The fact that he's even publicly responding here personally is already surprising to me.

Re: My account is sending spam emails

#142

Post by rigrassm »

teddyh wrote: post #132
sethvargo wrote: post #129

Earlier quoted context omitted.

1. I am a human. I promise :) 2. I apologize if my response came off as “PR speak” as that was not my intention. 3. I am trying to manage customer concerns. It’s why I’m responding on HackerNews and similar sites.

> I am trying to manage customer concerns You do that by providing actual information , not by corporate zero-information talk.

As mentioned elsewhere in the comments they are still working on actually fixing the issue.

They have already acknowledged it, given some details about what they believe to be the root cause, and implemented a band-aid fix for the time being. I'm sure once they have fully investigated and resolved the issue they will provide more details.

At this point, giving out details based on what they think is the issue now may end up being partially or even fully incorrect and that doesn't do anyone any good.

Re: My account is sending spam emails

#143

Post by herbst »

massaman_yams wrote: post #139
thaumaturgy wrote: post #47

Earlier quoted context omitted.

Yeah, this looks pretty straightforward. As I read it, it looks like telus.com has set up SPF records allowing people to send mail as @gmail.com via Telus' servers. That's fine. These messages are being sent with a "reply@telus.com" return address (the "envelope from"), but they are coming from gown.shoppingbrew.com and rine.play-wto.com (I don't get why there are separate received headers here from different sources…

Re: others forging your domain by using Gmail - this is only true in narrow edge cases like this one (which appears to have been relatively quickly fixed by Gmail). In practice, the Gmail and G suite UIs provide enforcement mechanisms to ensure you own a domain/address before allowing you to send from it. Does it potentially open you up to spoofing if another loophole/exploit like this is discovered? Sure. But as ris…

Adding to this. You can only use Gmail for sending with your own domains when you have 2FA enabled.

Re: My account is sending spam emails

#144

Post by bscphil »

jlgaddis wrote: post #118
appleiigs wrote: post #110

Earlier quoted context omitted.

Can you comment on what the issue actually is? Is the issue with gmail or telus or both?

A little bit of both, really. If Telus didn't have a misconfigured SPF record that caused host_check() to inadvertently (always?) return "pass", Gmail likely would have classified the messages as spam and the spammers probably would've quickly gave up. On the other hand, one could reasonably argue that Gmail -- with all of their advanced algorithms and such -- should have been able to easily determine that these mess…

I think there's a pretty solid argument that Google shouldn't be trusting Telus's SPF records. Just to take it to the extreme, suppose a spammer were to send emails through a gateway that they control. In that case, there would be no third-party with independent SPF records to rely on since the spammer would control them.

Google shouldn't need any "advanced algorithms" to tell that the message didn't originate from their own mail servers, or an SMTP client. I'd expect this ability from any email provider. I'd be shocked if this was possible at, e.g. Fastmail.

Re: My account is sending spam emails

#145

Post by aetherspawn »

To temporarily alleviate this issue, I created the following filter to stop my phone ringing constantly:

    from:(me@gmail.com|me@salesforce.com) to:(me@gmail.com) -{has:attachment}

    Mark as read
    Skip the inbox
Until I added this rule I was being pinged once a minute since lunch time yesterday.

This ignores: emails from me, or some sales force spammer they were using, to me, that doesn’t have an attachment (so I can still email myself files).

Re: My account is sending spam emails

#146

Post by morganvachon »

laurencei wrote: post #21

Exact same thing for me. Noticed I was getting emails being sent from myself. More worringly was the emails appeared in my SENT folder. For 5mins I was freaking out thinking I was hacked, because I didnt think spoofing emails would show up in MY "sent" folder. But I run 2FA, long complex unique password etc. I treat OpSec really highly. I checked all Google security settings, no unauthorised access, no apps using my…

I think this is exactly what is going on. Gmail doesn't use IMAP folders in the traditional sense, it uses labels. For something to appear in your "Sent" folder, it only has to show your email address as the sender. Since it's quite common for spammers to use your email address as the "From" in spam messages sent to you, Gmail automatically throws it in your Sent "folder" by way of a label.

I freaked out at first when my Fastmail account started getting spammed seemingly by my old Gmail account (I no longer use Gmail but I kept the account active and forwarded to Fastmail to catch anyone I forgot to update with the new address). I logged into Gmail and immediately changed my password, made sure I didn't have any third party app access, and turned on 2FA.

After seeing this HN piece and reading through the first few messages in the Google product forum, I realized it was typical spam that was breaking through Google's spam filter and freaking everyone out due to Google's handling of the Sent folder/label.

Re: My account is sending spam emails

#148

Post by Jaruzel »

sethvargo wrote: post #129
smt88 wrote: post #123

Earlier quoted context omitted.

This is exactly the kind of non-human PR speak that saturates Google's response to customers in all forums. Promises are half-made and always broken. There doesn't seem to be a will or desire to aggregate and manager customers' concerns. I hope this time is different, and your team really does share more information as it becomes available and relevant. I doubt it, though, and will switch to a mail provider that I pa…

1. I am a human. I promise :) 2. I apologize if my response came off as “PR speak” as that was not my intention. 3. I am trying to manage customer concerns. It’s why I’m responding on HackerNews and similar sites.

As no one else has, I am going to thank Seth for making the time to comment here. He didn't have to, and as he just said, he is human too.

Re: My account is sending spam emails

#150

Post by innocenat »

herbst wrote: post #143
massaman_yams wrote: post #139

Earlier quoted context omitted.

Re: others forging your domain by using Gmail - this is only true in narrow edge cases like this one (which appears to have been relatively quickly fixed by Gmail). In practice, the Gmail and G suite UIs provide enforcement mechanisms to ensure you own a domain/address before allowing you to send from it. Does it potentially open you up to spoofing if another loophole/exploit like this is discovered? Sure. But as ris…

Adding to this. You can only use Gmail for sending with your own domains when you have 2FA enabled.

Not really. It also works if you also lower your account security setting to low to enable 'Less-secured app' to login.
Post reply on HN