Live data from Hacker News

I Uncovered A Serious Gmail Security Bug

jdosstech.postach.io

21–23 of 23 posts

Re: I Uncovered A Serious Gmail Security Bug

#21
This is a not so well known feature, not a bug. You can also make more aliases by appending text after a + in your email address.

Sending email to miles.s.t.andish+123@gmail.com will still deliver email to milesstandish@gmail.com.

This is very helpful if you want to make multiple accounts on any website without going through the trouble of making multiple email addresses. Particularly helpful if you have multiple test accounts in your web application.

Re: I Uncovered A Serious Gmail Security Bug

#22
post #2

-1 cannot reproduce (possessing a gmail account without dots, I cannot create a similarly-named gmail account with dots in).

I indicated that in the post. However any existing account combination like this will route mail to both accounts presumably. I can certainly say that email intended for an account without the '.' will route to the account with the '.'

After the edit, point 2 and point 3 are directly contradictory.

Once someone has created j.smith@gmail, jsmith@gmail can no longer be created -- because they are the same account. It's not possible for you to have j.smith@gmail and someone else to have jsmith@gmail.

I get other peoples' mail all the time. It's not because gmail is misdelivering mail with dots in account names. It's because someone has another letter in their account that somebody left out (jjsmith, jpsmith, jsmith1, etc.) It's the sender, not gmail, who is directing the mail to the wrong inbox.

Re: I Uncovered A Serious Gmail Security Bug

#23
post #9

Earlier quoted context omitted.

It's impossible to receive email for someone else as Gmail blocks as unavailable all dot-added usernames when you signup for an account. E.g.: if you create abcdef@gmail.com, then a.bcdef@gmail.com , ab.cdef@gmail.com and so on become unavailable and are directed to your main account.

Not true. I have a "john.doe@gmail.com" account that is quite old and in the past year someone created the same account without the dot (johndoe@gmail.com), or at least started using it in the past year. I get email from one of their senders, or a copy I presume, to this day!

somebody thinks they have johndoe@gmail but they actually have johndoe1@gmail or johnpdoe@gmail or something like that.
Post reply on HN