6 ms·

Ask HN: Any one getting other people's emails in Gmail

19 points by x0054 10y ago

For about a year now I have been receiving other people's emails in my Google Apps email account. These are not spam emails, or misaddressed emails, these are emails that are clearly addressed to other people with completely different email addresses. It appears that the intended recipient also gets a copy of each email as sometimes I see back and forth conversations. I always delete these, and the volume is about 1 email per week or so. But what worries me a lot is, if I am getting other people's emails, what if other people, perhaps evil people, are getting my personal emails as well? I contacted Google about it several times and got no response. This sounds like the sort of thing they really should look into, but I don't now how to reach anyone there. Anyway, I was wondering, has this ever happened to anyone else?

mozreactor 10y ago
Hi. This is my first post here; I hope my contribution is worth something. This is fascinating! I was unaware of the "dot" thing in gmail addresses. I created my Google address including the dot and assumed it was a unique identifier. Occasionally I've received emails addressed to the non-dotted version and have wondered whether I'm being targeted for identity theft. I've received signup verifications for online services and, once, a legal letter demanding payment on an invoice for a person with my same name, whom I do know to be a real person living in my city, though not whether he is blood-related.
deleted 10y ago
[deleted]
rstormsf 10y ago
Are you CC'ed or BCC'ed to it?
- mirimir 10y ago
  Very likely. > ... Gmail strips the BCC recipient(s) from messages. The message is sent to the BCC recipient, but the BCC recipient is not displayed in the saved sent message. (The BCC recipient is also not displayed on Gmail's web-based interface if the message originated in Thunderbird.) https://support.mozilla.org/en-US/kb/thunderbird-and-gmail https://support.mozilla.org/en-US/kb/thunderbird-and-gmail
  - x0054 10y ago
    This could be the case, but I do not know any of these people, their names and emails are nothing like mine, and all of these emails are not spam, just people talking to each other about home repairs or the latest one was a LinkedIn Password reset email.
- x0054 10y ago
  I can't see it in the headers, it's possible, but unlikely.
mike-cardwell 10y ago
There is not really any connection between what is in the From/To/Cc headers of an email and where the email was actually sent from or to. For example, I just sent an email to my own GMail account and put "foo@example.com" in both the From and To headers. Here is a slighly obfuscated log of how I did it: mike@flan:~$ telnet gmail-smtp-in.l.google.com 25 Trying 2a00:1450:400c:c01::1a... Trying 74.125.71.26... Connected to gmail-smtp-in.l.google.com. Escape character is '^]'. 220 mx.google.com ESMTP s83si999899wmf.10 - gsmtp EHLO whatever 250-mx.google.com at your service, [*.*.*.*] 250-SIZE 157286400 250-8BITMIME 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-CHUNKING 250 SMTPUTF8 MAIL FROM:<foo@example.com> 250 2.1.0 OK s83si999899wmf.10 - gsmtp RCPT TO:<*****@googlemail.com> 250 2.1.5 OK s83si999899wmf.10 - gsmtp DATA 354 Go ahead s83si999899wmf.10 - gsmtp From: <foo@example.com> To: <foo@example.com> Subject: Hello World Hello . 250 2.0.0 OK 1467538374 s83si999899wmf.10 - gsmtp QUIT 221 2.0.0 closing connection s83si999899wmf.10 - gsmtp Connection closed by foreign host. Google even accepted that email and delivered it. Even after Google forwarded it on to my non-Google email address, it still had "foo@example.com" in both the From and To headers. It does not have my GMail address in there at all. I'm surprised google accepted that email actually. Seeing as it outright hard-failed SPF checks. example.com makes a pretty clear statement in their SPF record that it should never ever be used to send email ("v=spf1 -all")
- x0054 10y ago
  While what you say is totally true, but none of these emails are fishing emails, spam, or anything like that. It's just normal people emailing each other about home repairs, dinner, etc. The latest one was a LinkedIn password reset email, a real one, not a fake one. It was sent to an email address that looks nothing like mine.
  - mike-cardwell 10y ago
    Would you be able to provide the full raw headers for one of these emails?
bmh_ca 10y ago
Does your email have a dot in it? Gmail has a bug, if I recall correctly, where people would get email from addresses with the dot stripped (eg a.b@gmail.com would get email from ab@gmail.com) I myself regularly receive email that appears to be a result of this bug. I have never seen a fix.
- mshook 10y ago
  It's not a bug, it's a feature. This way people won't fake being you by creating an account with a dot in the user part of the email address (at least that's the way I see it eventhough I've never seen an official reason)... https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-more-from-your.html https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-mo...
  - bmh_ca 10y ago
    Fascinating. Except I created Gmail accounts with '.' in them and now get email intended for the Gmail accounts that do not. Interesting reference, thanks. I'm guessing my account was created before intended restrictions came into play.
NetStrikeForce 10y ago
I do have several people around the world giving out my email address as theirs. I get all sorts of weird email.
- mod 10y ago
  I also have this happening to me. I get texas dmv emails and sometimes signup emails from websites.
  - xuki 10y ago
    Especially if you have a short handle like firstname@gmail.com.
S4M 10y ago
Yeah I do get other people's email, but it seems to be more the sender's mistake than gmail's. My email is samuel.le@gmail.com, and people seemed to have been wanting to reach Samuelle <something> (Samuelle is a first name), Samuel Le <Something>, Samuel <something> Lee, etc. So far I've received an email from a sales person in a bank in Hong Kong offering me to buy some commodities derivatives, a non profit organization that takes care of mentally handicapped persons, a mover in the US, someone else flight ticket confirmation, some stuff written in Hebrew by a Rabbi, and many more... When the mail seems legit I reply to the sender explaining they sent it to the wrong person, and often they apologize. It happens roughly every month/two months so it's not a major annoyance and so far I haven't received anything super confidential or personal.
- patatino 10y ago
  "Gmail doesn't recognize dots as characters within usernames, you can add or remove the dots from a Gmail address without changing the actual destination address [1]" Your email adress is samuelle@gmail.com and not samuel.le@gmail.com [1] https://support.google.com/mail/answer/10313?hl=en https://support.google.com/mail/answer/10313?hl=en
  - S4M 10y ago
    Yes, the dot is completely optional, and I think it's one reason I got emails for other people. Senders wants to email to samuelle.something@gmail.com, somehow mistake it to samuelle@gmail.com and I end up being the recipient.
tedmiston 10y ago
Yes, I get this a lot as well. My email is <first initial><last name>@... and another, actually multiple people, with the same first initial and last name, but different first name appear to be confused. I receive real estate related emails for one person and credit card statements for another. I have attempted to report this to the CC company, but they require me to log in (to this user's account which I don't own with a company I don't have my own CC with) in order to create a ticket. It's been going on for over a year but I've been unable to get them to stop sending them to me. I guess they never considered this use case. In first-time cases I often reply when it involves a third party to kindly let them know. I also filter aggressively. That said, it seems too obvious a person could not know their own email address these days. Sometimes I wonder if these are stealthily designed target attacks of social engineering. One reason I never click the links.
mindaslab 10y ago
Once I created a private google doc containing my business idea, I saw that very same text when I searched for my business name. Thankfully Google showed only the first few lines in its general search. There is some data leak in Google. Its so big, something like this can happen.
superobserver 10y ago
Yes. This is one of the reasons why I wish Google implemented aliases for accounts anchored to a UID instead of requiring a persistent user account name. This is how Microsoft does it, actually. Then there might be a way to control for accounts that have similar names.

19 points by x0054 10y ago

mozreactor 10y ago

Hi. This is my first post here; I hope my contribution is worth something. This is fascinating! I was unaware of the "dot" thing in gmail addresses. I created my Google address including the dot and assumed it was a unique identifier. Occasionally I've received emails addressed to the non-dotted version and have wondered whether I'm being targeted for identity theft. I've received signup verifications for online services and, once, a legal letter demanding payment on an invoice for a person with my same name, whom I do know to be a real person living in my city, though not whether he is blood-related.

deleted 10y ago

[deleted]

rstormsf 10y ago

Are you CC'ed or BCC'ed to it?

mirimir 10y ago
Very likely. > ... Gmail strips the BCC recipient(s) from messages. The message is sent to the BCC recipient, but the BCC recipient is not displayed in the saved sent message. (The BCC recipient is also not displayed on Gmail's web-based interface if the message originated in Thunderbird.) https://support.mozilla.org/en-US/kb/thunderbird-and-gmail https://support.mozilla.org/en-US/kb/thunderbird-and-gmail
- x0054 10y ago
  This could be the case, but I do not know any of these people, their names and emails are nothing like mine, and all of these emails are not spam, just people talking to each other about home repairs or the latest one was a LinkedIn Password reset email.
x0054 10y ago
I can't see it in the headers, it's possible, but unlikely.

mike-cardwell 10y ago

There is not really any connection between what is in the From/To/Cc headers of an email and where the email was actually sent from or to. For example, I just sent an email to my own GMail account and put "foo@example.com" in both the From and To headers. Here is a slighly obfuscated log of how I did it: mike@flan:~$ telnet gmail-smtp-in.l.google.com 25 Trying 2a00:1450:400c:c01::1a... Trying 74.125.71.26... Connected to gmail-smtp-in.l.google.com. Escape character is '^]'. 220 mx.google.com ESMTP s83si999899wmf.10 - gsmtp EHLO whatever 250-mx.google.com at your service, [*.*.*.*] 250-SIZE 157286400 250-8BITMIME 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-CHUNKING 250 SMTPUTF8 MAIL FROM:<foo@example.com> 250 2.1.0 OK s83si999899wmf.10 - gsmtp RCPT TO:<*****@googlemail.com> 250 2.1.5 OK s83si999899wmf.10 - gsmtp DATA 354 Go ahead s83si999899wmf.10 - gsmtp From: <foo@example.com> To: <foo@example.com> Subject: Hello World Hello . 250 2.0.0 OK 1467538374 s83si999899wmf.10 - gsmtp QUIT 221 2.0.0 closing connection s83si999899wmf.10 - gsmtp Connection closed by foreign host. Google even accepted that email and delivered it. Even after Google forwarded it on to my non-Google email address, it still had "foo@example.com" in both the From and To headers. It does not have my GMail address in there at all. I'm surprised google accepted that email actually. Seeing as it outright hard-failed SPF checks. example.com makes a pretty clear statement in their SPF record that it should never ever be used to send email ("v=spf1 -all")

x0054 10y ago
While what you say is totally true, but none of these emails are fishing emails, spam, or anything like that. It's just normal people emailing each other about home repairs, dinner, etc. The latest one was a LinkedIn password reset email, a real one, not a fake one. It was sent to an email address that looks nothing like mine.
- mike-cardwell 10y ago
  Would you be able to provide the full raw headers for one of these emails?

bmh_ca 10y ago

Does your email have a dot in it? Gmail has a bug, if I recall correctly, where people would get email from addresses with the dot stripped (eg a.b@gmail.com would get email from ab@gmail.com) I myself regularly receive email that appears to be a result of this bug. I have never seen a fix.

mshook 10y ago
It's not a bug, it's a feature. This way people won't fake being you by creating an account with a dot in the user part of the email address (at least that's the way I see it eventhough I've never seen an official reason)... https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-more-from-your.html https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-mo...
- bmh_ca 10y ago
  Fascinating. Except I created Gmail accounts with '.' in them and now get email intended for the Gmail accounts that do not. Interesting reference, thanks. I'm guessing my account was created before intended restrictions came into play.

NetStrikeForce 10y ago

I do have several people around the world giving out my email address as theirs. I get all sorts of weird email.

mod 10y ago
I also have this happening to me. I get texas dmv emails and sometimes signup emails from websites.
- xuki 10y ago
  Especially if you have a short handle like firstname@gmail.com.

S4M 10y ago

Yeah I do get other people's email, but it seems to be more the sender's mistake than gmail's. My email is samuel.le@gmail.com, and people seemed to have been wanting to reach Samuelle <something> (Samuelle is a first name), Samuel Le <Something>, Samuel <something> Lee, etc. So far I've received an email from a sales person in a bank in Hong Kong offering me to buy some commodities derivatives, a non profit organization that takes care of mentally handicapped persons, a mover in the US, someone else flight ticket confirmation, some stuff written in Hebrew by a Rabbi, and many more... When the mail seems legit I reply to the sender explaining they sent it to the wrong person, and often they apologize. It happens roughly every month/two months so it's not a major annoyance and so far I haven't received anything super confidential or personal.

patatino 10y ago
"Gmail doesn't recognize dots as characters within usernames, you can add or remove the dots from a Gmail address without changing the actual destination address [1]" Your email adress is samuelle@gmail.com and not samuel.le@gmail.com [1] https://support.google.com/mail/answer/10313?hl=en https://support.google.com/mail/answer/10313?hl=en
- S4M 10y ago
  Yes, the dot is completely optional, and I think it's one reason I got emails for other people. Senders wants to email to samuelle.something@gmail.com, somehow mistake it to samuelle@gmail.com and I end up being the recipient.

tedmiston 10y ago

Yes, I get this a lot as well. My email is <first initial><last name>@... and another, actually multiple people, with the same first initial and last name, but different first name appear to be confused. I receive real estate related emails for one person and credit card statements for another. I have attempted to report this to the CC company, but they require me to log in (to this user's account which I don't own with a company I don't have my own CC with) in order to create a ticket. It's been going on for over a year but I've been unable to get them to stop sending them to me. I guess they never considered this use case. In first-time cases I often reply when it involves a third party to kindly let them know. I also filter aggressively. That said, it seems too obvious a person could not know their own email address these days. Sometimes I wonder if these are stealthily designed target attacks of social engineering. One reason I never click the links.

mindaslab 10y ago

Once I created a private google doc containing my business idea, I saw that very same text when I searched for my business name. Thankfully Google showed only the first few lines in its general search. There is some data leak in Google. Its so big, something like this can happen.

superobserver 10y ago

Yes. This is one of the reasons why I wish Google implemented aliases for accounts anchored to a UID instead of requiring a persistent user account name. This is how Microsoft does it, actually. Then there might be a way to control for accounts that have similar names.