Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Abusing Gmail to get previously unlisted e-mail addresses

blog.0day.rocks

Post reply on HN
Print view View original

31–40 of 51 posts

Re: Abusing Gmail to get previously unlisted e-mail addresses

#31

Post by forcer »

lxchase wrote: post #13

Email enumeration is often determined to be a UX choice rather than a security issue. I've explored this in the past with the idea of doing this to popular sites to build a demo/psychographic profile of an email address. Had a MVP hosted but not working at the moment. I remember sites included FB, Sephora, Home Depot, CafeMom, ESPN. Most have a XHR call to an API that determines if email exists or a message saying "Y…

That is very interesting! I wonder if some companies already doing that to "qualify" email addresses for sending spam, or more ethicaly enhancing their own email lists with this.

e.g. checking if my customers use competitors

Re: Abusing Gmail to get previously unlisted e-mail addresses

#32

Post by grouseway »

qb45 wrote: post #18
socket0 wrote: post #9

I'm going to have to agree with Google here, in that this isn't an exploitable security vulnerability. Knowing that the mailboxes famous.celebrity@gmail.com or controversial.journalist@gmail.com exist doesn't bring me any closer to exploiting the knowledge. I don't know that Famous Celebrity is in fact THE famous celebrity. I don't know whether Controversial Journalist still reads mail sent to that account. Most impo…

To verify the existence of a single account all you need to do is go to gmail.com and attempt logging into it. It's that simple. Sometimes you will even see the profile pic so you know who this user is or claims to be. The OP found a way to discover 40000 new addresses of random people per day by brute forcing through a dictionary-generated list of plausible candidates. Use it for Nigerian scams, Viagra ads, account…

Sounds like a SAAS - verify emails from gmail, hotmail, etc...

Re: Abusing Gmail to get previously unlisted e-mail addresses

#33

Post by nailer »

tyingq wrote: post #24

There's a more API friendly endpoint to do this that returns a nice JSON response, like this: {"input01":{"Valid":"false","ErrorMessage":"That username is taken. Try another.","Errors":{"GmailAddress":"That username is taken. Try another."},"ErrorData":[""]},"Locale":"en"} See: https://gist.github.com/saml/2268291

Checked and it still works too. Ported to node and added to: https://github.com/mikemaccana/is-gmail-account-valid

Re: Abusing Gmail to get previously unlisted e-mail addresses

#34

Post by elif »

laurencei wrote: post #15

I see companies trying to solve a similar issue on their password reset forms. They ask you to enter an email address - then give you a reply "if that email exists, we have sent a password reminder there". The problem is these sames sites have a self-signup, using a unique email as your login. So you can already find out if an email address is in use or not. If you've going to 'leak' the data one way or another, dont…

yeah but which signup form doesn't have a rate limit?

Re: Abusing Gmail to get previously unlisted e-mail addresses

#35

Post by lallysingh »

shinratdr wrote: post #26
Xylakant wrote: post #20

Earlier quoted context omitted.

Do the same thing on the signup page: If the email is already registered just progress the same way - send an email to that address and notify them that they already have an account.

Which is great for most accounts, but what about a primary? How do you sign up for Gmail without an email account in this case?

Use your shudder isp-provided one. Hello IAmBindingMyselfUnnecessarilyTo@comcast.net

Re: Abusing Gmail to get previously unlisted e-mail addresses

#36

Post by Dru89 »

grouseway wrote: post #32
qb45 wrote: post #18

Earlier quoted context omitted.

To verify the existence of a single account all you need to do is go to gmail.com and attempt logging into it. It's that simple. Sometimes you will even see the profile pic so you know who this user is or claims to be. The OP found a way to discover 40000 new addresses of random people per day by brute forcing through a dictionary-generated list of plausible candidates. Use it for Nigerian scams, Viagra ads, account…

Sounds like a SAAS - verify emails from gmail, hotmail, etc...

With as many accounts on these services that actually exist, it still doesn't answer the question of whether or not the person actually owns the email.

Re: Abusing Gmail to get previously unlisted e-mail addresses

#37

Post by Dru89 »

From what I can tell, this is a useful first step towards credential stuffing.

Requests against endpoints like this are going to be unauthenticated, since by their very nature they happen before the user is actually authenticated against the system. So you can burn through a few thousand (or hundred thousand) possibles and find out which ones actually have accounts.

From there, you can use one of many other email/password dumps and try authenticating. Hitting an endpoint where you can use an email and password is (hopefully) going to be much more guarded and will start blocking IPs when the rate or variance is too high.

That being said, I don't really know how you can stop the first step. There are plenty of answers here that say you should just let them "sign up" and then send them an email if they already have an account. But what happens if your signup process includes something like accepting payment? Obviously you don't want the user filling out all of that information again.

Re: Abusing Gmail to get previously unlisted e-mail addresses

#38

Post by Xylakant »

shinratdr wrote: post #26
Xylakant wrote: post #20

Earlier quoted context omitted.

Do the same thing on the signup page: If the email is already registered just progress the same way - send an email to that address and notify them that they already have an account.

Which is great for most accounts, but what about a primary? How do you sign up for Gmail without an email account in this case?

well, obviously this will not work for a primary account. It also adds friction the signup process, leading to lower conversion rations. But for some use-cases that may be a valid trade-off. Think dating sites, ..., stuff where knowing that a certain email is subscribed already may be embarrassing or worse (gay dating websites in certain countries).

Re: Abusing Gmail to get previously unlisted e-mail addresses

#40

Post by shinratdr »

Xylakant wrote: post #38
shinratdr wrote: post #26

Earlier quoted context omitted.

Which is great for most accounts, but what about a primary? How do you sign up for Gmail without an email account in this case?

well, obviously this will not work for a primary account. It also adds friction the signup process, leading to lower conversion rations. But for some use-cases that may be a valid trade-off. Think dating sites, ..., stuff where knowing that a certain email is subscribed already may be embarrassing or worse (gay dating websites in certain countries).

Oh absolutely, it's a good system and many sites already utilize it.

I only mentioned the Gmail example because that's what the article was about, it sounded like you were suggesting a solution for that scenario.

Post reply on HN