Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Uncovered A Serious Gmail Security Bug

jdosstech.postach.io

Post reply on HN
Print view View original

1–10 of 23 posts

Re: I Uncovered A Serious Gmail Security Bug

#3

Post by jdosstech »

mooism2 wrote: post #2

-1 cannot reproduce (possessing a gmail account without dots, I cannot create a similarly-named gmail account with dots in).

I indicated that in the post. However any existing account combination like this will route mail to both accounts presumably. I can certainly say that email intended for an account without the '.' will route to the account with the '.'

Re: I Uncovered A Serious Gmail Security Bug

#6

Post by mooism2 »

jdosstech wrote: post #3
mooism2 wrote: post #2

-1 cannot reproduce (possessing a gmail account without dots, I cannot create a similarly-named gmail account with dots in).

I indicated that in the post. However any existing account combination like this will route mail to both accounts presumably. I can certainly say that email intended for an account without the '.' will route to the account with the '.'

No, the list of instructions at the start of the post indicates that you can create an account like miles.standish@gmail.com even if there is already an account like milesstandish@gmail.com.

If that is not what you mean, you should edit it to make it clearer.

Re: I Uncovered A Serious Gmail Security Bug

#7

Post by jdosstech »

johansch wrote: post #4

http://gmailblog.blogspot.se/2008/03/2-hidden-ways-to-get-mo... https://support.google.com/mail/answer/10313?hl=en This has been there since launch, afaik.

Thanks! Hard to believe they would let this go. The email I receive that is intended for someone else is not something I would want others to see if I were them.

Re: I Uncovered A Serious Gmail Security Bug

#8

Post by vehementi »

jdosstech wrote: post #7
johansch wrote: post #4

http://gmailblog.blogspot.se/2008/03/2-hidden-ways-to-get-mo... https://support.google.com/mail/answer/10313?hl=en This has been there since launch, afaik.

Thanks! Hard to believe they would let this go. The email I receive that is intended for someone else is not something I would want others to see if I were them.

What? It's by design of gmail. I am skeptical that you possess two accounts like first.last@gmail.com and firstlast@gmail.com that are actually distinct accounts. The person sending you email probably typed the wrong email address.

Re: I Uncovered A Serious Gmail Security Bug

#9

Post by vladd »

jdosstech wrote: post #7
johansch wrote: post #4

http://gmailblog.blogspot.se/2008/03/2-hidden-ways-to-get-mo... https://support.google.com/mail/answer/10313?hl=en This has been there since launch, afaik.

Thanks! Hard to believe they would let this go. The email I receive that is intended for someone else is not something I would want others to see if I were them.

It's impossible to receive email for someone else as Gmail blocks as unavailable all dot-added usernames when you signup for an account.

E.g.: if you create abcdef@gmail.com, then a.bcdef@gmail.com , ab.cdef@gmail.com and so on become unavailable and are directed to your main account.

Re: I Uncovered A Serious Gmail Security Bug

#10

Post by jdosstech »

mooism2 wrote: post #6
jdosstech wrote: post #3

Earlier quoted context omitted.

I indicated that in the post. However any existing account combination like this will route mail to both accounts presumably. I can certainly say that email intended for an account without the '.' will route to the account with the '.'

No, the list of instructions at the start of the post indicates that you can create an account like miles.standish@gmail.com even if there is already an account like milesstandish@gmail.com. If that is not what you mean, you should edit it to make it clearer.

Done.
Post reply on HN