Live data from Hacker News

The dots do matter: how to scam a Gmail user

jameshfisher.com

271–280 of 518 posts

Re: The dots do matter: how to scam a Gmail user

#271
post #69

Earlier quoted context omitted.

If you have a bug in a system, do you fix it at the source, or do you fix it at all the leaves? Netflix might be wrong here, but fixing it at Netflix doesn't make the problem go away. Fix the problem once (GMail) and never ever have to deal with it again.

There is no bug in Gmail. This bug has nothing to do with Gmail, it is with Netflix not clearly communicating when verifying the address a user claims to own.

While I agree with you from a technical perspective, Netflix isn't going to be the only one with this particular issue. If you addressed the issue at gmail, you can be sure you've fixed it for all the little leaves.

Re: The dots do matter: how to scam a Gmail user

#272
My work-around:

1. Create a filter on "To", with correct dotting, with the action being to apply a new tersely-named label e.g. "dot".

2. Color all instances of the new label a greenish shade to signify goodness. Do this by going back to Inbox, hovering over the name of your new label, clicking on the downward triangle, and following the menus from there.

Anything incoming lacking the green label is a suspect.

Re: The dots do matter: how to scam a Gmail user

#273
It's a Gmail issue. I sometime gets wrong mail coz of this FEATURE. Not talking about any specific site. Gmail to Gmail only.

Just to clarify with an example: My email is: abcd.wxyz@gmail.com Other guy: abcdwxyz@gmail.com

I wonder how many of my emails the other is receiving. All my stuff is linked with Gmail. Any suggestions to resolve this?

Re: The dots do matter: how to scam a Gmail user

#274
post #129

Earlier quoted context omitted.

I actually have dots in my Netflix account email address because somebody who wasn't me had previously started to register for Netflix using my email address. I have had to do this with some other services as well. Some services won't allow the + in gmail addresses, which is pretty annoying. If a service starts recognising the dots don't matter and denying the plus symbol, there's a good chance I won't be able to reg…

Why can't you claim the original accounts?

The thought did cross my mind. But there's something that feels weird about claiming an account that I never set up, especially where it's not clear if the service allows payment or usage with an unverified email address.

I personally don't believe the penalty for putting my email address in instead of yours (which could be very close) should be complete account hijack. Instead, I usually just filter the messages to trash.

I would much prefer to be able to click a link saying "I didn't expect this email." Very few services actually do this.

There will be some people who read the OP and see treating dots in email addresses where dots don't matter as another thing on their todo list for a signup form.

A more considered approach would be to think about how you handle emails. A lot of the time the email is the most important thing -- access to the email address is often the only credential you need to get into the account, so you want it to be correct before anybody spends time entering details.

You can make sure there are no mistakes by giving users a link to click within a window of time (e.g. 7 days), before they can enter any data associated with that account. Provide a link that says "nothing to do with me." Do not count the account as real until the link has been visited.

In the case of the linked article, Netflix asking for billing information before confirmation of email address is a clear example of a threat vector that has far more to do with Netflix prematurely pestering for payment than it does with Gmail aliasing email addresses.

Re: The dots do matter: how to scam a Gmail user

#275
post #148

Earlier quoted context omitted.

That's exactly how it works today with the added benefit that the user does not have to enumerate the list and it's hard for other people to squat on slight variations to your email.

That isn't how it works today. They do not display any warning, and you have to hover your name to see what address it was sent to.

The infuriating part is that one can't reply from the address it was sent to, only from the one that's primary.

Re: The dots do matter: how to scam a Gmail user

#276
post #253

Earlier quoted context omitted.

IIRC, not quite literally, but pretty close. The email RFCs in general tend to be much less constrained than one might expect.

Yup. Even spaces are allowed if you put double quotes around the local part: “Kevin Spacey”@example.com. It’s really surprising, there’s very little that can be verified if you strictly follow the RFC.

This is a common issue with text based formats and ietf/RFCs. HTTP allows comments in some headers. And allows line breaks:

  H: hi
    Mom
Is the same as

  H: hi Mom
Bets on how many http clients and servers get this right? Without losing speed?

My guess is when you're not responsible for ensuring compatibility or having to deal with writing robust, fast, code, the temptation to be cute with your format overtakes things.

Re: The dots do matter: how to scam a Gmail user

#277
post #4

I really wish that I could tell google to bounce all the emails that don’t match my “dot pattern” I’m now in complete control of someone else’s commercial business hvac account because of precisely this problem. And the worse part is that I don’t know the correct email to get ahold of this person. They’ve set up library appointments, I received a receipt for a down payment on a lake house, basically most of this pers…

I'm now in complete control of someone else’s commercial business hvac account because of precisely this problem. But that has absolutely nothing to do with the dots. Indeed, almost every comment about this has nothing to do with the dots, including the submission. Someone entered the wrong email address, and in the process got yours. It isn't like the dotted or undotted one is legitimately theirs -- it can't possibl…

I agree there's that fundamental problem with the way email gets handled.

But at the same time I still wish Gmail would stop you from receiving emails on addresses other than the one you created yourself (ie by treating dots like any other character). It'd save me from getting several misdirected emails per day.

It's true that all these misdirected emails come down to people misremembering their addresses, but I think you're overlooking an important class of such misremembering (which can be addressed on its own).

I have a dot in my actual email address. There are several people who have a similar address who must be forgetting that their email address actually contains an additional initial or number. However some of these people do not have the dot in their actual email address.

I.e my email address: this.that@gmail.com

The other email addresses: thisnthat@gmail.com, thisthat7@gmail.com, etc

...where the other addresses get misremembered as: thisthat@gmail.com

I get these peoples' emails, but that could be easily avoided if Gmail took note of the dots.

Re: The dots do matter: how to scam a Gmail user

#278
post #86

Earlier quoted context omitted.

The standard email verification patterns rely on the user clicking a link. I am not sure how that would have helped here. Making users retype the email (instead of merely click on a link) might be better for exposing scams but requires more work on the user’s part.

Ultimately the bug relies on how believable the emails from Netflix are. If I got an email from Netflix asking me to update card details, I wouldn’t be surprised because maybe my card expired. But if I got an email asking to verify my new account, I would be very surprised. I didn’t sign up for a new Netflix account. If after that, I got an email to update my card details, I would be alarmed because of the recent une…

Yes, I've received emails of the form, "You recently signed up on our website for Fooflix, please confirm by clicking here. If you did not recently sign up, please disregard this email. Anyway, now that this is a known problem, both Netflix and Gmail should take reasonable steps to mitigate.

Re: The dots do matter: how to scam a Gmail user

#279
post #113
post #94

Earlier quoted context omitted.

Dot's don't matter if the relevant RFC says they don't matter and I think this is the case. Google follows the standard, Netflix does not.

Nope. RFC 5321: "the local-part MUST be interpreted and assigned semantics only by the host specified in the domain of the address". That means it's actually technically against the RFC to do any normalization of the local-part (like ignoring dots or case).

By that logic, jacksmith@example.com and johnjsmith@example.com could be delivered to the same mailbox. When I read TFA my first thought was "what does the standard say about it" and it does sound like Netflix is the one making the wrong assumption here.

But I also see his point about how this can confuse users who don't realize this or are not using this behavior intentionally.

Post reply on HN