Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The dots do matter: how to scam a Gmail user

jameshfisher.com

Post reply on HN
Print view View original

351–360 of 518 posts

Re: The dots do matter: how to scam a Gmail user

#351

Post by zargon »

esdott wrote: post #330

The real kicker here though is that it IS possible to have registered a separate email address in gmail with a dot. My wife has been dealing with this in the opposite, she has a valid first.last@gmail and another person has a separate firstlast@gmail. She has the dot but frequently gets emails for the non dot address. We’ve gotten to know the person over like 10 years. If we’re victims of some sort of con game, then…

You should realize that there is no additional gmail account registered with no dots. Just your wife's account. And somebody simply signs up for things using your wife's address, because they feel like it should be theirs. This is a very common thing. https://xkcd.com/1279/

Re: The dots do matter: how to scam a Gmail user

#352

Post by astura »

w0rd-driven wrote: post #187
notpeter wrote: post #78

Earlier quoted context omitted.

This is true of gmail accounts as well. If you signed up with first.last you always must login with first.last. The real issue is that old account names are actually case sensitive too. Starting a few years ago Google normalized all account creation to lowercase, but existing case sensitive accounts remain. We implemented OAuth, normalizing accounts to lowercase in our db and everything was fine for years until we ra…

My wife has found this is absolutely not the case for gmail. She consistently gets firstnamelastname emails instead of firstname.lastname which is the one she signed up with. To test a theory I told her to login as both using the same password. Both go to her gmail account. Logging in without the dot shows the address as still firstname.lastname. My assumption at the time is during signup Google strips the dot and it…

If what the GP said is true it sounds like nobody else signed up for the "non dot version" before Google normalized accounts. Gmail would only treat the accounts different if first.last and firstlast weren't the same people.

Re: The dots do matter: how to scam a Gmail user

#353

Post by tolztekh »

gnicholas wrote: post #33

> but I also have access to the account because I own james.hfisher@gmail.com, and so I can follow the password reset process for this account. I did so. I wonder if others feel that it is ethical or unethical to log into other people's accounts in this situation. I get lots of emails resulting from people typo'ing my email address instead of theirs—and the unsubscribe links are often hidden behind a login page. But…

I'm receiving other peoples mail all the time. My first gmail account was about 13-14 years old. Recently i'm receiving mails from Argentina constantly about museum trips, school meetings of people. I reply them explaining that i am from far far away and notify the person about the situation. When i check the "To:" section, the mails sent myhandle67@gmail.com or myhande.78@gmail.com.

My other gmail account is namesurname@gmail.com and i receive about 6-7 of different peoples mail with the same name surname combination. It happened in hotmail also btw.

I got phone bills, cargo shipment details, hospital working schedule documents, private messages from a marriage social network kind of a site. I can easily login to the site with link in the mail and can read all his really private messages, flirting with the ladies.

I called the phone bill guy, his parents answered it a little panicking, i explained them the situation. But the mails keep coming, so i call the phone company. They said they take action immediately but nothing changed.

I called the cargo guy tell him his cargo is on his way and who i am. He surprised and confused like others when he heard a guy with the same name surname called him.

I called the hospital, someone else answered. Explain him the situation to let him know. He was surprised and asked me if i have the last months schedule pdf because it got lost or something.

I couldn't reach the old womanizer guy, contact the site and mails stopped.

I'm not using the dot feature myself but somethings not working correctly with it i guess. In this particular case i think Netflix should validate the e-mail addreses.

Re: The dots do matter: how to scam a Gmail user

#355

Post by astura »

Gigablah wrote: post #348
esdott wrote: post #330

The real kicker here though is that it IS possible to have registered a separate email address in gmail with a dot. My wife has been dealing with this in the opposite, she has a valid first.last@gmail and another person has a separate firstlast@gmail. She has the dot but frequently gets emails for the non dot address. We’ve gotten to know the person over like 10 years. If we’re victims of some sort of con game, then…

But how do you know that the other person registered a gmail account, as opposed to, say, them registering the wrong email address with the email senders?

Send an email and see if that email shows up in your inbox?

Re: The dots do matter: how to scam a Gmail user

#357

Post by MichaelGG »

loeg wrote: post #304
MichaelGG wrote: post #276

Earlier quoted context omitted.

This is a common issue with text based formats and ietf/RFCs. HTTP allows comments in some headers. And allows line breaks: H: hi Mom Is the same as H: hi Mom Bets on how many http clients and servers get this right? Without losing speed? My guess is when you're not responsible for ensuring compatibility or having to deal with writing robust, fast, code, the temptation to be cute with your format overtakes things.

I expect all commonly used HTTP clients (Chrome, Firefox, IE, even libcurl) and servers (Apache, Nginx, does IIS still exist?) get this right.

I, too, would expect that the most common pieces of software with massive amounts of engineering time invested get it right (but almost certainly with a performance hit). But I'd be unsurprised to find that one doesn't handle the http parsing spec correctly somewhere.

The issue is that such a spec is entirely unneeded and overly complicated. No benefit, only downsides. And for something as simple as basic parsing rules! Not even getting into anything that should be difficult.

Re: The dots do matter: how to scam a Gmail user

#358

Post by mattbierner »

Email addresses should only be used as contact info, not as a login name (and login names should also be different from your display/user name). Maybe I’m paranoid, but many sites will gladly tell anyone who knows your email that you at least have an account there. As the browser/password manager already fills in the password, why not just randomly generate the login name too? I currently use email aliases and burner email addressees on sites that don’t handle this well
Post reply on HN