5 ms·

Is this really even a big issue? For one, you have to already have knowledge of the email address in advance. Then you have to somehow get this user to go to a

Is this really even a big issue? For one, you have to already have knowledge of the email address in advance. Then you have to somehow get this user to go to a page that you have control over. Then you have to get them to wait around on your page while you run through 1000 possible email addresses every 25 seconds. Unless this got onto a really, really compelling page, I don't think anyone is going to sit around waiting for a page like this to do its business. The chances of getting a successful match are so low that I can understand why it's not a priority to fix this.

raldi 9y ago
I could use this to make a website where, when an HN admin looked at it, it looked great, but when anyone else did, it was full of ads, redirected to malware, or whatever. Reddit could use it to figure out whether various celebrities were redditors and track what they look at. Even if they never log in! And if they did log in, reddit could find out what their username was. And that's just what I was able to think up in 30 seconds.
- dpkonofa 9y ago
  With your first example, you could do that but it wouldn't be realistic to do that. Like I said, you'd have to know the admin's logged in Google email address already and then they'd have to sit on that page for over 2 hours before you even hit a statistical probability of a match. It would really only work if you were trying to target one specific person. If you were fishing for users from a leak of users or something, this would literally do nothing. As for the Reddit option, Reddit would already know if the celebrities were redditors because they'd have to know their email address in advance anyways for this trick to work. No celebrity is going to risk setting up a Reddit account without an email address so Reddit already has that info. On top of that, what's reddit going to do with a celebrity's email address and username? It's already required for verification on anything important a celebrity would use it for (like an AMA or promos). Val Kilmer is a redditor. What exactly would I gain from knowing if Val Kilmer is logged in to his Google account?
  - raldi 9y ago
    > they'd have to sit on that page for over 2 hours before you even hit a statistical probability of a match. No, it would be instantaneous. If you have a specific email address in mind, you test it, and immediately get "yes, it's them" / "no, it's not them" in milliseconds. > No celebrity is going to risk setting up a Reddit account without an email address Huh? You don't think famous people have pseudonymous Internet accounts? > Val Kilmer is a redditor. What exactly would I gain from knowing if Val Kilmer is logged in to his Google account? "Val Kilmer's secret reddit username is i_love_horse_porn"
    - dpkonofa 9y ago
      >No, it would be instantaneous. If you have a specific email address in mind, you test it, and immediately get "yes, it's them" / "no, it's not them" in milliseconds. Again...you'd already have to know the email address and what benefit does it give you to know that this specific person is logged in? You'd have to somehow get that specific person to visit your page in the first place. >pseudonymous Internet accounts I know they do. I just don't see what that gets me if I already know their email address. >i_love_horse_porn The only people that would be able to gather this information from this exploit are Reddit admins and they'd already have that information from the email address. Even still... what would they even do with that information?
      - askmike 9y ago
        > Again...you'd already have to know the email address and what benefit does it give you to know that this specific person is logged in? You can link users (that you target) to specific websites (that you indirectly control, even through something like a malicious ad). > The only people that would be able to gather this information from this exploit are Reddit admins and they'd already have that information from the email address. Even still... what would they even do with that information? No! I (as a non admin) could create a website that uses this exploit right now and link targets (like reddit admins of which I know the gmail) to my website. Post the website to reddit, and voila. Once they visit the site I know they did.
- notatoad 9y ago
  wouldn't you have to know the target's email in advance in both of those examples? And not just their email address, but the email address of the Google account they stay logged in to while browsing. If you know a celebrity's email address, you can probably do more than just show them targeted content on your website.
  - raldi 9y ago
    $ dig -t mx ycombinator.com [...] ycombinator.com. 300 IN MX 10 aspmx.l.google.com. Looks like ycombinator.com is a Google enterprise domain. Three guesses what pg's email address probably is.
bluesign 9y ago
Only works if you target specific user with known email address. Other than that I dont see any possible use.
- askmike 9y ago
  That still sounds scary enough to me.
DINKDINK 9y ago
>Is [non consensual user-information leaking] really even a big issue? Yes
fencepost 9y ago
Useful as a general tool for identifying visitors? No. Useful as a spearphishing tool for getting to specific people? Absolutely. What do you figure as the likelihood that there are people in positions of power or influence right now who are using pseudonymous email addresses from third party providers? I'd peg it at near 100%,though I'm not in a position to identify specific ones.
nothrabannosir 9y ago
> Is this really even a big issue? Security rule of thumb: when you ask this question, you've lost. Look around the comment section for examples. To put it crudely: you may lack creativity, but your attackers don't. It's impossible to enumerate all possible applications of an attack vector. Be strict.

raldi 9y ago

I could use this to make a website where, when an HN admin looked at it, it looked great, but when anyone else did, it was full of ads, redirected to malware, or whatever. Reddit could use it to figure out whether various celebrities were redditors and track what they look at. Even if they never log in! And if they did log in, reddit could find out what their username was. And that's just what I was able to think up in 30 seconds.

dpkonofa 9y ago
With your first example, you could do that but it wouldn't be realistic to do that. Like I said, you'd have to know the admin's logged in Google email address already and then they'd have to sit on that page for over 2 hours before you even hit a statistical probability of a match. It would really only work if you were trying to target one specific person. If you were fishing for users from a leak of users or something, this would literally do nothing. As for the Reddit option, Reddit would already know if the celebrities were redditors because they'd have to know their email address in advance anyways for this trick to work. No celebrity is going to risk setting up a Reddit account without an email address so Reddit already has that info. On top of that, what's reddit going to do with a celebrity's email address and username? It's already required for verification on anything important a celebrity would use it for (like an AMA or promos). Val Kilmer is a redditor. What exactly would I gain from knowing if Val Kilmer is logged in to his Google account?
- raldi 9y ago
  > they'd have to sit on that page for over 2 hours before you even hit a statistical probability of a match. No, it would be instantaneous. If you have a specific email address in mind, you test it, and immediately get "yes, it's them" / "no, it's not them" in milliseconds. > No celebrity is going to risk setting up a Reddit account without an email address Huh? You don't think famous people have pseudonymous Internet accounts? > Val Kilmer is a redditor. What exactly would I gain from knowing if Val Kilmer is logged in to his Google account? "Val Kilmer's secret reddit username is i_love_horse_porn"
  - dpkonofa 9y ago
    >No, it would be instantaneous. If you have a specific email address in mind, you test it, and immediately get "yes, it's them" / "no, it's not them" in milliseconds. Again...you'd already have to know the email address and what benefit does it give you to know that this specific person is logged in? You'd have to somehow get that specific person to visit your page in the first place. >pseudonymous Internet accounts I know they do. I just don't see what that gets me if I already know their email address. >i_love_horse_porn The only people that would be able to gather this information from this exploit are Reddit admins and they'd already have that information from the email address. Even still... what would they even do with that information?
    - askmike 9y ago
      > Again...you'd already have to know the email address and what benefit does it give you to know that this specific person is logged in? You can link users (that you target) to specific websites (that you indirectly control, even through something like a malicious ad). > The only people that would be able to gather this information from this exploit are Reddit admins and they'd already have that information from the email address. Even still... what would they even do with that information? No! I (as a non admin) could create a website that uses this exploit right now and link targets (like reddit admins of which I know the gmail) to my website. Post the website to reddit, and voila. Once they visit the site I know they did.
notatoad 9y ago
wouldn't you have to know the target's email in advance in both of those examples? And not just their email address, but the email address of the Google account they stay logged in to while browsing. If you know a celebrity's email address, you can probably do more than just show them targeted content on your website.
- raldi 9y ago
  $ dig -t mx ycombinator.com [...] ycombinator.com. 300 IN MX 10 aspmx.l.google.com. Looks like ycombinator.com is a Google enterprise domain. Three guesses what pg's email address probably is.

bluesign 9y ago

Only works if you target specific user with known email address. Other than that I dont see any possible use.

askmike 9y ago
That still sounds scary enough to me.

DINKDINK 9y ago

>Is [non consensual user-information leaking] really even a big issue? Yes

fencepost 9y ago

Useful as a general tool for identifying visitors? No. Useful as a spearphishing tool for getting to specific people? Absolutely. What do you figure as the likelihood that there are people in positions of power or influence right now who are using pseudonymous email addresses from third party providers? I'd peg it at near 100%,though I'm not in a position to identify specific ones.

nothrabannosir 9y ago

> Is this really even a big issue? Security rule of thumb: when you ask this question, you've lost. Look around the comment section for examples. To put it crudely: you may lack creativity, but your attackers don't. It's impossible to enumerate all possible applications of an attack vector. Be strict.