4 ms·

Appears this is a non-issue. For those who have been following. Matt Langley (the person who "discovered" the issue) has been posting updates here: http://nam

by arn 15y ago

Appears this is a non-issue. For those who have been following. Matt Langley (the person who "discovered" the issue) has been posting updates here: http://namesake.com/conversation/mattlangley/i-just-accidental-hacked-paypal-it-took-30-seconds-and-i-had-total-access-to-someone-elses-account-im-shocked-what-does-the-community-think-of-the-total-lack-of-security-measurer-used-by-paypal-basically-they-gave-me-access-to-someones-bank http://namesake.com/conversation/mattlangley/i-just-accident... Relevant post: "It seems that the 'victim' had opened an account using an email address of mine, with extra characters thrown in, which Gmail ignores and accepts as the same email address, so it was gmail which uncorrupted the email address and sent the emails to me, not Paypal. I had previously reported an account set-up with fraudulent email address to Paypal many times in the past, but only yesterday noticed that the email address was different to mine, in a way which on any other email system in the world would be a different email address. Cheeky bugger. I'm gonna have to ask them to close it down or at least change the email address. but I guess I owe you all an apology" - Matt Langley edit: someone else posted this too. so, some commentary. This should have been verified before posting, as it has caused some trouble for people who delinked their account etc. That said, I understand the rapid news cycle of blogging, though with something this potentially serious, I would think it would need to be verified. Side note, first time I'd seen Namesake and it's kinda cool. Wish I could search.

andypants 15y ago
When you sign up for a gmail address, all dot variations of the email address belong to you. So if you have andzdroid@gmail.com, then emails to andz.droid@gmail.com will also go to you, and a.n.d.z.d.r.o.i.d@gmail.com will also go to you. What happened to the OP is that somebody signed up using a variation of his email. Obviously, if I signed up at paypal with YOUR email address, you'd start receiving MY paypal emails. There is no vulnerability. Only stupid people signing up with other peoples' emails.
- zeedotme 15y ago
  he's receiving emails from a fraudulent account that was set up with his email address but with a "." in it. I can't see the vulnerability there but it is important to point out. Paypal should be aware that Gmail allows it. I just created 3 different paypal accounts with the three different email addresses that only differ by the position of the dot.
  - MattLangley 15y ago
    Yup. More importantly, they should verify email addresses at registration time and delete accounts which don't get verified. Almost all other sites do this. It's simple best practice and it stops them spamming third parties.
    - thisisblurry 15y ago
      I'm surprised PayPal doesn't already do this. (My account is years old, so I don't know their current practices for creating new accounts). Twitter and Facebook both do.
- MattLangley 15y ago
  Yup, that's about the size of it.
- staktrace 15y ago
  You can also tack on a +<anything> to your gmail. So if you have example@gmail, you also own example+foo@gmail, example+bar@gmail, and so on.
- ja27 15y ago
  But there continue to be reports that GMail has some issues with the dots where andzdroid@gmail.com and andz.droid@gmail.com can be two different accounts: http://www.google.com/support/forum/p/gmail/thread?tid=60cbf54a7bea10b0&hl=en http://www.google.com/support/forum/p/gmail/thread?tid=60cbf... http://www.google.com/support/forum/p/gmail/thread?tid=2d9f38bf10a53893&hl=en http://www.google.com/support/forum/p/gmail/thread?tid=2d9f3...
  - mauriciob 15y ago
    This is just people that don't know how GMail works. Quoting your first link: > I receive internal business emails addressed to this other guy and when I email him back, it comes back to me. It obviously will come back to him, because the guy is emailing himself.
eik3_de 15y ago
completely OT: > Side note, first time I'd seen Namesake and it's kinda cool. This reminds me of convore. Does anyone know who was first?
- pama 15y ago
  Namesake is indeed kinda cool. I created an entry for a separate discussion: http://news.ycombinator.com/item?id=2661165 http://news.ycombinator.com/item?id=2661165
deleted 15y ago
[deleted]

by arn 15y ago

andypants 15y ago

When you sign up for a gmail address, all dot variations of the email address belong to you. So if you have andzdroid@gmail.com, then emails to andz.droid@gmail.com will also go to you, and a.n.d.z.d.r.o.i.d@gmail.com will also go to you. What happened to the OP is that somebody signed up using a variation of his email. Obviously, if I signed up at paypal with YOUR email address, you'd start receiving MY paypal emails. There is no vulnerability. Only stupid people signing up with other peoples' emails.

zeedotme 15y ago
he's receiving emails from a fraudulent account that was set up with his email address but with a "." in it. I can't see the vulnerability there but it is important to point out. Paypal should be aware that Gmail allows it. I just created 3 different paypal accounts with the three different email addresses that only differ by the position of the dot.
- MattLangley 15y ago
  Yup. More importantly, they should verify email addresses at registration time and delete accounts which don't get verified. Almost all other sites do this. It's simple best practice and it stops them spamming third parties.
  - thisisblurry 15y ago
    I'm surprised PayPal doesn't already do this. (My account is years old, so I don't know their current practices for creating new accounts). Twitter and Facebook both do.
MattLangley 15y ago
Yup, that's about the size of it.
staktrace 15y ago
You can also tack on a +<anything> to your gmail. So if you have example@gmail, you also own example+foo@gmail, example+bar@gmail, and so on.
ja27 15y ago
But there continue to be reports that GMail has some issues with the dots where andzdroid@gmail.com and andz.droid@gmail.com can be two different accounts: http://www.google.com/support/forum/p/gmail/thread?tid=60cbf54a7bea10b0&hl=en http://www.google.com/support/forum/p/gmail/thread?tid=60cbf... http://www.google.com/support/forum/p/gmail/thread?tid=2d9f38bf10a53893&hl=en http://www.google.com/support/forum/p/gmail/thread?tid=2d9f3...
- mauriciob 15y ago
  This is just people that don't know how GMail works. Quoting your first link: > I receive internal business emails addressed to this other guy and when I email him back, it comes back to me. It obviously will come back to him, because the guy is emailing himself.

eik3_de 15y ago

completely OT: > Side note, first time I'd seen Namesake and it's kinda cool. This reminds me of convore. Does anyone know who was first?

pama 15y ago
Namesake is indeed kinda cool. I created an entry for a separate discussion: http://news.ycombinator.com/item?id=2661165 http://news.ycombinator.com/item?id=2661165

deleted 15y ago

[deleted]