Get your own domain, problem solved. Hanging out where the rest of the world are is bound to cause problems.
The dots do matter: how to scam a Gmail user
281–290 of 518 posts
Re: The dots do matter: how to scam a Gmail user
#282Earlier quoted context omitted.
If Google fixed dots-don't-matter, couldn't someone still sign up for Netflix with jameshfisher+netflix@gmail.com? If Netflix checks for + address duplicates, then that's not an issue. But you could still have the situation where someone signs up for, let's say, Hulu with your standard jameshfisher@gmail.com account. And then you could still end up paying if you forget whether you ever signed up for Hulu or not (mayb…
A similar problem exists for weird services like Amazon that allow multiple accounts for the same email address (unless they finally fixed that stupid idea?).
Doesn't seem stupid to me. In the real world can have multiple accounts with a business using the same physical address. Why should contact information be limited to a single account? Why should an email address be assumed to uniquely identify a person? Email sharing is still very common, and many organizations have addresses like info@ or help@ that don't identify anyone at all and could be read by any number of people.
Re: The dots do matter: how to scam a Gmail user
#283Earlier quoted context omitted.
I was under the impression that literally anything goes on the left side of the @. It’s all up to the individual mail server
Even things at the right side of the @ are up to the E-Mail server. You can send an E-mail to @gmail.com or @GMAIL.COM and Google could be routing it differently. It'll resolve the same in DNS, but what the user typed will be encoded in E-Mail headers, and you could route differently depending on whether it's upper-case, mixed-case or whatever.
Not true, domain part is case insensitive by the standard.
Server can decide for non-standard behavior, but that would be foolish.
Re: The dots do matter: how to scam a Gmail user
#284As an aside, it seems a lot of people assume your email address is just your first name and last name with "@gmail.com" tacked on the end.
I get a lot of emails for other Evans this way. I've had wedding invitations, been CC'd in on rental dispute discussions and all sorts of stuff because of this assumption.
The most recent was an invitation to edit a 5th grade basketball roster google doc. So at the top of the document I wrote a politely worded rant on the subject of email addresses. At the same time, the original author was editing the document and trying to delete my rant as I was typing it, so we had a little battle going on for a few minutes. I reckon that's one person who will never do that again.
Re: The dots do matter: how to scam a Gmail user
#285Earlier quoted context omitted.
I think these are orthogonal issues. The dots do matter, but Netflix should also validate email addresses. However, I don't think it's as critical. Lack of email validation means I receive someone else's ride details (I agree, annoying), but dots-don't-matter means I might accidentally pay for that person's rides.
Thinking about this a bit more, I believe that there is another problem with how account creation is done. In general we do it in two steps: 1. User detail and password 2. E-mail confirmation Instead, if we did 1. User details but NOT password 2. E-mail confirmation and subsequently entering the password on the page that was sent via e-mail. Actually, I think the most optimal would be 1. Enter e-mail address only 2.…
Maybe I don't understand the second option, but it seems to me that if you do the second option and a wrong email address is provided in step 1, then in step 2, the wrong person can take ownership of the account and provide his own password. So I agree with codetrotter that the third option is best of the three, to protect the two people from each other.
The possible disadvantage I see with the third option however is that if you are at a service desk, and they are trying to sign you up for a membership of some sort, they can't complete your registration on the spot. You would have to go home and use the computer to complete your registration (unless you can use email client on your smartphone). Which means they may lose a possible member if they don't ensure that you finish the registration right there and then.
For that reason it may be better to collect the email address, all customer details, and the desired password (typed twice). Then when the confirmation link is sent, the confirmation link should take you to a link that asks you for your password again (once) before your account is validated. This ensures that the person at the service desk is really the person using the email account to do the validation. Mere access to the email account should not be enough. The main advantage here is to make sure as little work as possible is left to the customer to do by himself when he gets home. I agree that this is a lot more messy than Doug Webb's approach, because the only accounts in that approach are validated accounts.
However to the extent that one does not want to lose a possible new membership because someone went home and decided not to continue the process because it is a lot of work, it may be worth it.
Re: The dots do matter: how to scam a Gmail user
#286I have multiple "e-mail doppelgangers" - confused people who don't know their own email address and so accidentally use my address when they register stuff. One's in Chile. I have almost no knowledge of Spanish. The other is in California. Having experienced this: Services need to email new email accounts they become aware of ASAP. They have literally zero UI available to me to notify them that this is an invalid ema…
I have a very short email address and get lots of these. What I do is immediately log in to the service and change the password. Then, if possible, I log out any other devices that are logged in.
Then they can never access the account and continue to to use the service.
Where available, I will delete the account as well.
I found that if I don't do this, then I am just going to be receiving notification emails forever from that account.
Re: The dots do matter: how to scam a Gmail user
#287I really wish that I could tell google to bounce all the emails that don’t match my “dot pattern” I’m now in complete control of someone else’s commercial business hvac account because of precisely this problem. And the worse part is that I don’t know the correct email to get ahold of this person. They’ve set up library appointments, I received a receipt for a down payment on a lake house, basically most of this pers…
Anytime this happens to me, I immediately log in and change the password.
They can work with customer service to get the email corrected.
Re: The dots do matter: how to scam a Gmail user
#288The article shines light on three separate failures on Netflix's part:
1. Canonicalize email addresses
Whether or not dots or +asdf is considered okay, an email address used for identification needs to be canonicalized in order to avoid duplicate sign-ups.
2. Never leak information through sign-up forms
A login attempt either succeeds or fails. That is all the user should know. Telling the user if the attempted email address exists or does not exist is a privacy breach and a security breach as demonstrated in this article.
3. Never assume ownership of an email address until it is verified
Some services verify email addresses at some point in the user flow, some never verify, and few verify at the right point. The best sign-up flow I've seen is Slack where setting a password is part of the email verification flow and a user cannot set a password and own the account until they have verified the email address.
Thus, sending transactional emails beyond verify your email or reset your password before the email address has been verified opens one up to security breaches as in the case of Netflix.
Re: The dots do matter: how to scam a Gmail user
#289Earlier quoted context omitted.
In the initial submission, without the dots issue though, the wrong address entered wouldn't be able to match an existing user.
That's why you send an email to whatever the user typed in with a link they have to click before they can complete the signup process. This is really, really basic stuff.
Yes, I agree. My point was just that the dots did have an effect in the initial submission story.
Re: The dots do matter: how to scam a Gmail user
#290Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.
Not only that, but apparently he was able to change Eve's account details without having to enter a password.
If instead Netflix had prompted him before allowing him to change the credit card, it would not have worked, because he wouldn't have known Eve's password and Eve wouldn't have known his.
All around very bad security design on Netflix's part.