4 ms·
This is nothing. I have a very common name and a very common surname and people have used my email (name.surname at gmail.com plus the infamous GMail variants
by HelloNurse 5y ago
This is nothing.
I have a very common name and a very common surname and people have used my email (name.surname at gmail.com plus the infamous GMail variants such as namesurname or NameSurname) for purposes like accounts on dating sites, Spotify, Instagram etc.; invoices; banks and insurances; resumes and job applications; medical test results; newsletters and all kinds of personal communications.
"I" am a local politician, a Swiss or Italian banker, a boyfriend deserting some girl in Argentina, a rugby player, a professor or two; "I" buy screws, magic tricks, diving suits; I know several of "my" birth dates and addresses and I have easily identified a couple of correspondents.
In most cases there is no practical way to verify email addresses, particularly if the person is really convinced that their email is the wrong one or that some approximation is allowed, and without actual payment collections coming your way little harm is done.
I sometimes complain to web sites with inexcusable confirmation-less registrations or reclaim accounts on services I might want to use, but for the most part I just let incorrect emails accumulate to play the passive game of collating them and consolidating identities (e.g. is the person who follows cooking courses in a certain big city the same who received from a friend bus timetables for that city?).
- darshitpp 5y agoWe are on the educated side of the internet populace. I can only imagine worse things when this happens to the non-educated, especially in developing countries like India, where almost everyone has an (mobile) internet connection these days. It's interesting to think about how the very basis of our internet identities, that is the email, can be so easily abused by someone who has bad intent.
- OisinMoran 5y ago> In most cases there is no practical way to verify email addresses What's wrong with "Click the link in the email we just sent to x@x.com to verify your email"?
- rerx 5y agoA malicious recipient can click the link and exploit that their email is now associated to the account of some other person.
- dmurray 5y agoThis seems like a relatively small vulnerability in practice. But it could be mitigated by "click the link and enter the one time code we gave you at sign-up time". Too much friction? How about "click the link on the same browser you used to sign up, and we'll verify that using a cookie we just set" - functionally equivalent and probably works for 90% of users while the rest can fall back to the one time code. I've seen a handful of sites do something like this in practice. No idea why it's not more common: presumably most people don't roll their own verification process so if some major web frameworks adopt it we'll eventually see it more widely.
- feupan 5y ago> presumably most people don't roll their own verification process Oh boy. Auth is that thing that looks so easy because you just need to store an md5 password to feel like hackerman. If people actually used existing solutions, web logins wouldn’t be in such dire conditions.
- HelloNurse 5y agoAllowing password reset requests (or activating the account in full) before the email is verified, so that I can reset the password and take over the account, means that the holder of the email prevails over the password holder: a severe protocol design error, which can be made even worse by accepting payments before the email is verified or by restricting account creations attempts. Not all careless stupidity should be attributed to the website admin, however: assholes using random email addresses and phone numbers deserve to be punished, and knowing one's own email addresses is a basic literacy requirement.
- fragmede 5y agoor just make a verified email address part of the required sign-up flow. No click on registration link, no further access to account.
- tomrod 5y agoNeeds a follow up of "re-enter password" I think?
- buro9 5y agoI have a similar situation. My most recent one was Apple telling me my id was reset by my request. This definitely came from Apple, was verifiable... But it turned out some person entered my email on their support case and it almost gave me access to their entire Apple account, the support people were willing to go through everything with me as I had the email. It was only when I asked for the transcript of what I'd apparently said to them that alarm bells rang on their end and they finally investigated enough and escalated enough and determined my email was not the one that had anything to do with the account in question. Mostly I ignore the email I receive, but once in a while it has enough details that I can find the person involved and give them their train tickets, or car insurance docs, etc.
- Macha 5y agoYeah, I have firstnamel@gmail.com for my actual name. I get this from time to time, but 90% of the mixups are actually down to one guy, an older latino guy (judging by the surname used) with interests in car rentals, ford trucks on second hand sites, and dating sites. He's given my email so many times, I'm convinced he thinks it's actually his email.
- fragmede 5y agoAt least Google Workspaces now shows the profile pic for the recipient. I can forget the exact right permutation of firstname.middleinitial.lastname@gmail.com, but when the profile pic is wrong, I can be sure I've mistyped something.