24 ms·
Using Gmail “Dot Addresses” to Commit Fraud
- mindslight 8y agoAn email address should not be treated as some kind of closed-world constraining identifier, but purely as an open-world point of contact. The suggestion seems to be that businesses should view Gmail addresses with dots as a sign of "abuse", presumably how the same broken philosophy views Mailinator addresses. In reality if you're concerned about either of these, you're doing something wrong. Schneier should know better than to give credence to this snake oiled tripe.
- wuunderbar 8y ago> Each of these accounts is associated with a different stolen identity, but all email from these services are received by the same Gmail account. Thus, the group is able to centralize and organize their fraudulent activity around a small set of email accounts, thereby increasing productivity and making it easier to continue their fraudulent behavior. I'm sure there are creative & compelling uses of Gmail dot addresses to commit fraud out there, but this one barely counts as fraud. I'm not sure what the point of the article is.
- SketchySeaBeast 8y agoYeah, it's a time saver for the fraudster, but that's really about it.
- ggggtez 8y agoThe fraudster indeed could just forward the netflix mail using their own mail server. This is just standard phishing (when you log in to netflix, wouldn't you notice it's not your account?)
- gruez 8y agoAgreed. You could write the same article about catchall forwarding services or disposable mail service.
- josteink 8y agoIf you use a disposable email, I guess you should consider the account disposable too? If you have catch-all service forwarding your email, you as a technically minded person made that choice for your domain and you have to consider the consequences and risks. Gmail has made this a default for everyone, including 99.999999% of its users who does not know scammers can automatically create aliases for them, so that the 0.0000001% which uses this feature doesn’t have to tick a checkbox first, or pre-register their aliases. Completely irresponsible and a world of difference.
- deweller 8y agoFraudsters are taking advantage of email aliases to get other people to pay for someone else's account. Example: 1) Fraudster create an account and put in a bogus card number. 2) Fraudster changes account email address to joe.smith@gmail.com. joesmith@gmail.com already exists in Netflix's DB - but joe.smith@gmail.com does not, so Netflix is ok with this. 3) Netflix emails joe.smith@gmail.com and says "hey your card is bad, please update it" by clicking here. 4) The real joesmith@gmail.com receives the email, clicks the link and is taken directly to a "update your card screen" and types in their credit card information. 5) Fraudster has their Netflix account paid for by the real Joe Smith. Granted, Netflix could fix this by requiring a login before updating billing details. But the dot aliases in Gmail are a part of the scam.
- SketchySeaBeast 8y agoYeah, the other link(1) is more interesting. That's still not exactly a world shattering level of fraud though. Unless they subscribe to the 4k package, then we're getting unreasonable. 1) https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-gmail-user.html https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-t...
- koolba 8y agoNetflix would be at fault there for allowing the email change without confirmation. Rule #1 of security: trust nothing from the client!
- giornogiovanna 8y ago> Thus, the group is able to centralize and organize their fraudulent activity around a small set of email accounts, thereby increasing productivity and making it easier to continue their fraudulent behavior. How were Gmail's dot-addresses a central feature of this fraud? It looks like it just made it a tiny bit more convenient. And regarding the Netflix example, why isn't it 100% on them for not verifying email addresses?
- ganoushoreilly 8y agoI agree, it implies they were using the . as a means to generate new emails vs the . actually playing a pivotal role in a specific compromise. I've actually used the . and + feature for years to manage different accounts.
- throwaway5752 8y agoI know, this is infuriating. Dots and extensions are part of the spec, and it's the fault of the party mishandling them.
- vkhn 8y agoI've used dot addresses in referral queues to bump myself up the queue. Remember the Oneplus referral based phone ordering/shipping? Yep, I cheated that one just to see if it would work. It did.
- wtmt 8y agoThe part about tricking Netflix users was posted and discussed here before. [1] [1]: https://news.ycombinator.com/item?id=16781959 https://news.ycombinator.com/item?id=16781959
- asaph 8y agoWhat other vanity email providers besides Gmail implement "dot addresses" or similar systems for their email addresses? Update: The table on this wikipedia page provides a list under the "Address Modifiers" column. Curiously, it doesn't mention dot addresses for Gmail, only plus addressing. https://en.wikipedia.org/wiki/Comparison_of_webmail_providers#Features https://en.wikipedia.org/wiki/Comparison_of_webmail_provider...
- ASalazarMX 8y agoIf we're nitpicking, it would be why Google allows dot aliases for regular accounts, but not for G Suite, while allowing plus-sign aliases for both.
- nerdkid93 8y agoIf I had to guess, because corporate admins want to have separate inboxes for people with similar names... 1 with a "." and one without.
- ASalazarMX 8y agoThat's more trouble than it's worth. davebowman@corp.net and dave.bowman@corp.net will receive many emails not intended to them.
- zAy0LfpBZLC8mAC 8y agoWhat a dumb article. Whoever considers email addresses to be identities is an idiot, they are not, they are simply a contact address, and obviously you can have as many of those as you want. If your software can't deal with this fact, your software is broken.
- leni536 8y ago> The account "bruceschneier@gmail.com" maps to the exact same address as "bruce.schneier@gmail.com" and "b.r.u.c.e.schneier@gmail.com" -- and so on. Just a minor nit: the distinct addresses map to the same inbox or google account. I fail to see how this breaks email.
- ASalazarMX 8y agoWait till he finds out about bruceschneier+whateveryouwant.@gmail.com
- ASalazarMX 8y agoThis is a non-issue, I'm surprised it's on front page. If you can defraud companies just by making email aliases, what's stopping those hardened criminals from just registering new addresses? Companies have had procedures for dealing with duplicate addresses/telephones/email addresses since forever, and if they don't, it's a fault of their business model.
- golem14 8y agohttps://github.com/kdeldycke/awesome-falsehood#emails https://github.com/kdeldycke/awesome-falsehood#emails
- tfandango 8y agoI was convinced someone was trying to perpetrate fraud against me using my gmail address w/o the dots. I just didn't understand how. I continuously got (and still get) emails from Amazon about app purchases (all free) because someone has created an account using my gmail address minus the dots. I have called Amazon 3 times and each time they have either removed my address from the other person's account, or deactivated the account (or so they said). And then I finally got an email from someone, the alleged fraudster? Asking me to stop using their email address......
- nerdkid93 8y agoThis is a poorly sourced article. Where does this metric come from? > Submit 48 credit card applications at four US-based financial institutions, resulting in the approval of at least $65,000 in fraudulent credit How does one even open a line of credit with just an email address?
- mike503 8y agoCan someone flag this as bullshit?
- seba_dos1 8y agoI have a catch-all domain. Just imagine all the fraud possibilities!