The dots do matter: how to scam a Gmail user • Hacker News Board

Re: The dots do matter: how to scam a Gmail user

#391

Post by hanspeter » Sun, Apr 08, 2018, 6:26 AM UTC

spinsser wrote: post #390

hanspeter wrote: post #386

Earlier quoted context omitted.

> the web form shouldn't indicate anything out of the ordinary How will the user know that the registration failed and what to do about it?

Upon entering a valid email (whether it is already registered or not) the form will show the following notification "an email was sent to user@email.com with the sign up instructions, please follow the link in the email to continue the registration" (rewrite for more concise message) If the user already exists the email will be a warning + a link to the password reset form If the user does not exist, the email will b…

Got it.

Re: The dots do matter: how to scam a Gmail user

#392

Post by jsnell » Sun, Apr 08, 2018, 6:33 AM UTC

jjeaff wrote: post #337

jsnell wrote: post #70

Earlier quoted context omitted.

At least three people have successfully created a Netflix account with my gmail address, written in exactly the same way I would normally write it: Jessica in 2012, John in 2013, and Jen in 2017. The first two somehow managed to recover and change the email address, the last one never did. (So maybe it's now finally blocked off from further registrations.) If any of them had shared my name, the effect would have been…

I feel like you are being a bit harsh. What is really the exposure in this case? I can't really imagine that there are that many blackhats trying to get free Netflix accounts when torrents or Usenet gets you more content anyway. And while yes, there is some friction getting torrents, it's not nearly as much as trying to phish multiple people in hopes that they will pay for your account.

All kinds of other problems follow from not verifying the emails, for both the person who owns the email account and the person owning the Netflix account. In addition to this kind of targeted attack:

- When these accounts were active, I'd keep getting email from Netflix that I could not stop receiving.

- In the first two cases, I could have done a password reset on the accounts and just started using them. The original owner would have to continue paying for it, since they'd have no way to disassociate the CC from the account.

- In the third case the user didn't get the account back at all after forgetting their password (maybe no recovery phone number?). They lost all their viewing history and probably also ended up paying Netflix for service they had no way of using.

From a technical perspective, this email handling is total garbage. The only persons winning are on growth hacker scumbags who get to write slides every quarter about how they lose no customers in the email verification part of the signup funnel.

Re: The dots do matter: how to scam a Gmail user

#393

Post by EugeneOZ » Sun, Apr 08, 2018, 6:40 AM UTC

This happens when some company makes own sub-standard over existing. To follow their standard about dots, all programmers should hardcoode gmail.com domain check about dots.

Re: The dots do matter: how to scam a Gmail user

#394

Post by tspike » Sun, Apr 08, 2018, 6:40 AM UTC

hawktheslayer wrote: post #223

uiri wrote: post #189

Earlier quoted context omitted.

It really bothers me the number of web services which reject email addresses containing '+' in the local part. If you're going to try to "validate" an email address, read the goddamn RFCs.

I like the idea of adding +spam@gmail.com, but it would be really easy for this to be invalidated by just stripping this from your email before selling it in a mailing list.

I recently decided to ditch Gmail because I don't trust Google any more than Facebook. One nice side effect of this is that now that I'm using my own domain, all company signups can be to me@spam.domain.com, which is much harder to filter well.

Re: The dots do matter: how to scam a Gmail user

#395

Post by ksk » Sun, Apr 08, 2018, 6:44 AM UTC

sandov wrote: post #320

ksk wrote: post #313

Earlier quoted context omitted.

Where does it matter? Can you give an example?

If I send an email to John@company.com instead of john@company.com and the server of company.com is configured to be case sensitive, then john will never see my email.

I see, so not relevant in the real world. Thanks!

Re: The dots do matter: how to scam a Gmail user

#396

Post by fyi1183 » Sun, Apr 08, 2018, 6:55 AM UTC

DougWebb wrote: post #266

codetrotter wrote: post #82

Earlier quoted context omitted.

Thinking about this a bit more, I believe that there is another problem with how account creation is done. In general we do it in two steps: 1. User detail and password 2. E-mail confirmation Instead, if we did 1. User details but NOT password 2. E-mail confirmation and subsequently entering the password on the page that was sent via e-mail. Actually, I think the most optimal would be 1. Enter e-mail address only 2.…

Typically when I implement user self-registration for my portal-website clients, I use a variation of your third option: 1. Enter email address and some out-of-band information that only an existing-account-holder should know. Eg: a web portal for a utility company could ask for the account number and amount due from a recent bill. 2. Send confirmation email with a code/link. 3. After user enters a valid code, contin…

Please don't use recovery Q&A.

As a user, I cannot trust that a website gets the recovery flow right. Some websites will allow you to bypass email and password if you know the answer to the question. Because of that, I cannot put in the real answer, as that would be a massive security risk.

So I usually put in some random garbage, which means it's essentially a second password. Well, if I lost my first password, chances are good that I lost the second password as well.

So please, don't do security questions. Just send a password reset link by email.

If you're worried about stuff like payment info stored in the account, just ask me to re-enter those details after I changed my password.

Re: The dots do matter: how to scam a Gmail user

#397

Post by homero » Sun, Apr 08, 2018, 7:08 AM UTC

Franciscouzo wrote: post #338

ThoAppelsin wrote: post #336

Earlier quoted context omitted.

Perhaps Netflix people are to blame for taking +tagged mail addresses as different than the ones that are not tagged. It is a well-acknowledged [1] and commonly offered feature by the email providers that should have been accounted for. Dots-don't-matter, on the other hand, is very specific to Google, and they simply do matter in many other (if not all other) email providers. I think Netflix shouldn't be blamed for n…

I'd hate it if websites started implementing that, I like being able to register to the same site with the same email multiple times.

Yeah I do it all the time

Re: The dots do matter: how to scam a Gmail user

#398

Post by zan » Sun, Apr 08, 2018, 7:13 AM UTC

There are more ways to resolve this.

- Netflix shouldn't charge cards without verifying email addresses. Security should be an integral part of UX, and not subservient to it.

- Individual email address canonicalisation/resolve _could_ actually be a standard. I'm not sure whether it is or not, but if we can agree on emoji we could also maybe agree on something that binds the internet together. Email is infrastructure, Netflix is not.

- There is still a potential issue by having configured catch-all email addresses on some domains, but we should in that case optimise for the hundreds of millions of gmail.

Re: The dots do matter: how to scam a Gmail user

#399

Post by LoSboccacc » Sun, Apr 08, 2018, 7:19 AM UTC

Sir_Substance wrote: post #132

hn_throwaway_99 wrote: post #3

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.

>This is Netflix's issue for not validating the email account. Eeeh, I just re-read RFC 2822. It explicitly states that the local-part of an address may contain any number of dots as long as they are separated by (if I'm reading this correctly) at least one character, and do not start with a dot. There's nothing in there that states you should treat dotted and undotted variants of an address as the same address. So,…

The spec say that the server can alias valid addresses as much as they like and the sender should not assume any form of aliasing.

Netflix second guessing the aliasing pattern is the bug

Re: The dots do matter: how to scam a Gmail user

#400

Post by giomasce » Sun, Apr 08, 2018, 7:21 AM UTC

theclaw wrote: post #308

kbsletten wrote: post #292

Earlier quoted context omitted.

He said in the post that he was able to reset the password because the account was linked to "his" email.

But if you have to reset the password to update the credit card details, then surely the scam won't work because the scammer would no longer be able to use the account. For this scam to work the "Update your credit card" mail must contain a credential that allows you to update the scammer's card without changing or being challenged for their password. That doesn't seem great.

Fully agree. All authentication operations should always be completely explicit and clearly display the identity you are authenticating to. An email link implicitly logging you in looks like completely unacceptable. The email to recover your password can be excepted, because it is clearly an authentication-related thing and maintain the invariant that at most one person is actually able to log in.