The dots do matter: how to scam a Gmail user • Hacker News Board

Re: The dots do matter: how to scam a Gmail user

#331

Post by Pxtl » Sun, Apr 08, 2018, 2:12 AM UTC

spc476 wrote: post #312

quasarj wrote: post #196

Earlier quoted context omitted.

Yep, same here. I've got a "DJ" in the US, but also a guy in India. The Indian guy is always getting legal threats for not paying his phone bill.. I feel a bit bad that he's not even getting the emails, but I have no idea how to actually contact either of these people...

Reply to the sender then, saying they have the wrong email account. That's what I do and over time it cuts down on the incorrect email I get.

Half the time these emails come from donotreply@domain.tld

Re: The dots do matter: how to scam a Gmail user

#332

Post by chrisweekly » Sun, Apr 08, 2018, 2:22 AM UTC

AndrewSnow wrote: post #42

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

Absolutely. I don’t blame people who don’t interact with email for not reading the relevant RFCs, but not verifying control and expecting local part uniqueness to mean uniqueness of users is obviously busted to anyone who has worked with email. This is Netflix failing to understand part of their product surface. Both the dot behavior and the even more common ‘+’ feature are perfectly spec compliant.

Yeah they're both spec-compliant, but (IIRC, as of a few months ago), in gmail at least, there's a huge difference:

janedoe+acme@gmail.com resolves to janedoe@gmail.com, and the "+acme" is simply a useful bit of metadata for Jane to track the provenance of the sender's mailing list. the "+" and anything following it are ignored. It signifies an optional suffix.

Whereas janedoe.acme@gmail.com resolves to janedoeacme@gmail.com -- a completely different address than janedoe@gmail.com. The "." is simply ignored as if it weren't there, making j.anedoeacme and jane.doeacme and janedoe.acme equivalent.

Yeah this is specific to how gmail chooses to handle these spec-compliant-though-often-mishandled characters, but anyone who works with email professionally absolutely has to come to terms with how gmail works.

Re: The dots do matter: how to scam a Gmail user

#333

Post by whitexn--g28h » Sun, Apr 08, 2018, 2:23 AM UTC

Reset that password and change all the contact info, now you have two netflix accounts!

Re: The dots do matter: how to scam a Gmail user

#334

Post by kevin_thibedeau » Sun, Apr 08, 2018, 2:25 AM UTC

pryce wrote: post #321

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

Absolutely - his proposed solution - disabling the dots-dont-matter feature and retiring them does nothing to stop this exact same attack vector instead employing the '+' feature that he admires and wishes to retain. The attack goes like this: * Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher. * Eve creates a Netflix account w…

Moreover some broken email validators reject plus addresses. It's nice to be able to fall back on special dot combos when you want to keep track of sites selling your email to spammers.

Re: The dots do matter: how to scam a Gmail user

#335

Post by joedj » Sun, Apr 08, 2018, 2:29 AM UTC

jamesrcole wrote: post #277

endorphone wrote: post #65

Earlier quoted context omitted.

I'm now in complete control of someone else’s commercial business hvac account because of precisely this problem. But that has absolutely nothing to do with the dots. Indeed, almost every comment about this has nothing to do with the dots, including the submission. Someone entered the wrong email address, and in the process got yours. It isn't like the dotted or undotted one is legitimately theirs -- it can't possibl…

I agree there's that fundamental problem with the way email gets handled. But at the same time I still wish Gmail would stop you from receiving emails on addresses other than the one you created yourself (ie by treating dots like any other character). It'd save me from getting several misdirected emails per day. It's true that all these misdirected emails come down to people misremembering their addresses, but I thin…

I do this, using a Google Apps script to send any emails to unexpected addresses to Spam.

Something like this: https://stackoverflow.com/questions/24540743/how-to-spam-fil...

Re: The dots do matter: how to scam a Gmail user

#336

Post by ThoAppelsin » Sun, Apr 08, 2018, 2:35 AM UTC

pryce wrote: post #321

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

Absolutely - his proposed solution - disabling the dots-dont-matter feature and retiring them does nothing to stop this exact same attack vector instead employing the '+' feature that he admires and wishes to retain. The attack goes like this: * Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher. * Eve creates a Netflix account w…

Perhaps Netflix people are to blame for taking +tagged mail addresses as different than the ones that are not tagged. It is a well-acknowledged [1] and commonly offered feature by the email providers that should have been accounted for.

Dots-don't-matter, on the other hand, is very specific to Google, and they simply do matter in many other (if not all other) email providers. I think Netflix shouldn't be blamed for not accounting for provider-specific, non-standard equivalences.

Email address verification alone doesn't seem to fix all the erroneous aspects of this issue: Let's say Netflix was requesting verification, and then you receive the email for the +tagged mail address. Shouldn't it say that you already own a Netflix account, instead of asking for a verification at that point?

[1] https://tools.ietf.org/html/rfc5233

Re: The dots do matter: how to scam a Gmail user

#337

Post by jjeaff » Sun, Apr 08, 2018, 2:40 AM UTC

jsnell wrote: post #70

jamesfisher wrote: post #21

Earlier quoted context omitted.

I'm sorry, this sentence wasn't clear, and I agree with you. What I meant by this was: - Some would say that Netflix should verify the email address on sign up, but there's no obvious attack that this mitigates. Using someone else's address on signup only cedes account control to them. - Others would say that Netflix should disallow the registration of james.hfisher@gmail.com when a Netflix account already existed fo…

At least three people have successfully created a Netflix account with my gmail address, written in exactly the same way I would normally write it: Jessica in 2012, John in 2013, and Jen in 2017. The first two somehow managed to recover and change the email address, the last one never did. (So maybe it's now finally blocked off from further registrations.) If any of them had shared my name, the effect would have been…

I feel like you are being a bit harsh. What is really the exposure in this case?

I can't really imagine that there are that many blackhats trying to get free Netflix accounts when torrents or Usenet gets you more content anyway.

And while yes, there is some friction getting torrents, it's not nearly as much as trying to phish multiple people in hopes that they will pay for your account.

Re: The dots do matter: how to scam a Gmail user

#338

Post by Franciscouzo » Sun, Apr 08, 2018, 2:40 AM UTC

ThoAppelsin wrote: post #336

pryce wrote: post #321

Earlier quoted context omitted.

Absolutely - his proposed solution - disabling the dots-dont-matter feature and retiring them does nothing to stop this exact same attack vector instead employing the '+' feature that he admires and wishes to retain. The attack goes like this: * Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher. * Eve creates a Netflix account w…

Perhaps Netflix people are to blame for taking +tagged mail addresses as different than the ones that are not tagged. It is a well-acknowledged [1] and commonly offered feature by the email providers that should have been accounted for. Dots-don't-matter, on the other hand, is very specific to Google, and they simply do matter in many other (if not all other) email providers. I think Netflix shouldn't be blamed for n…

I'd hate it if websites started implementing that, I like being able to register to the same site with the same email multiple times.

Re: The dots do matter: how to scam a Gmail user

#339

Post by stephen_g » Sun, Apr 08, 2018, 2:43 AM UTC

DougWebb wrote: post #266

codetrotter wrote: post #82

Earlier quoted context omitted.

Thinking about this a bit more, I believe that there is another problem with how account creation is done. In general we do it in two steps: 1. User detail and password 2. E-mail confirmation Instead, if we did 1. User details but NOT password 2. E-mail confirmation and subsequently entering the password on the page that was sent via e-mail. Actually, I think the most optimal would be 1. Enter e-mail address only 2.…

Typically when I implement user self-registration for my portal-website clients, I use a variation of your third option: 1. Enter email address and some out-of-band information that only an existing-account-holder should know. Eg: a web portal for a utility company could ask for the account number and amount due from a recent bill. 2. Send confirmation email with a code/link. 3. After user enters a valid code, contin…

I wish requiring validation was still the norm. I get that services and sites want to reduce “friction” and get people using it right away, but anybody like me with fairly generic gmail address knows, many people don’t know their own email address. I must have hundreds of active accounts linked to that email that I didn’t sign up for (although I’m sure a lot of them can’t be logged into anymore and the people can’t recover their passwords). That account became unusable, I got my own domain account a decade or so ago to replace it but still look in there occasionally.

Please though, anybody implementing signups - if you are going to let people sign up without validating email addresses, put a “I didn’t sign up for this account” link in every email you send.

Re: The dots do matter: how to scam a Gmail user

#340

Post by Someone1234 » Sun, Apr 08, 2018, 2:44 AM UTC

fvargas wrote: post #288

The article shines light on three separate failures on Netflix's part: 1. Canonicalize email addresses Whether or not dots or +asdf is considered okay, an email address used for identification needs to be canonicalized in order to avoid duplicate sign-ups. 2. Never leak information through sign-up forms A login attempt either succeeds or fails. That is all the user should know. Telling the user if the attempted email…

> Whether or not dots or +asdf is considered okay, an email address used for identification needs to be canonicalized in order to avoid duplicate sign-ups.

Since it isn't a standard or norm, how would that work? These are gmail exclusive features, and other services have other unique features.