4 ms·

Someone constantly adds my Gmail address as their Gmail account's backup address. I constantly remove it whenever Gmail sends me the notification. I can't hel

Someone constantly adds my Gmail address as their Gmail account's backup address. I constantly remove it whenever Gmail sends me the notification. I can't help but think there is some method for the other person to steal my Gmail account if I never remove my email as their backup.

Romario77 8mo ago
I logged in several times to other people's accounts and reset their passwords. But it's too tiring, people keep adding my email. I hope it's because I have small simple email and not because they want to steal it.
- nativeit 8mo ago
  You’re confessing to several actual felonies here, may want to change strategies.
  - kstrauser 8mo ago
    “…and so I made him the owner of my account, and he used that to remove himself from it!” “We’ll be right over.”
    - thatguy0900 8mo ago
      You forgot the part where he reset their email he didn't own and change their passwords so they couldn't get back into it
      - kstrauser 8mo ago
        I think you’re misreading this. OP has an email account. Someone else signed up for some website that doesn’t verify that you own the address before allowing you to log in and use the service. If the site did verify it, the user wouldn’t have been able to log in because OP would have been getting the verification emails, and not the user. Later, after OP told the user and they failed to change their address, OP logged into the site and changed their password, putting an end to the spam they were receiving from the user’s actions. I don’t have an ethical qualm with this. He didn’t want to sign up for the service. Someone else signed his email address up for it. Legally, I can’t imagine that being prosecutable.
        NikolaNovak 8mo ago
        One thing I've found, occasionally the hard way, is that helpful bystanders are always offering advice based on "ethical", "intuitive", "logical" and "common sense", usually without any aspect of "legal". I got divorced a decade ago, and every well-wishing person in my life was strongly urging me to do things which were shockingly counter-productive / dangerous / wrong, based on their confident understanding (assumption, really) of the law which was completely and dangerously inaccurate. Hacker News audience is global. People start accounts for various purposes. Yet people still freely share the notion that logging in to some unknown website run by an unknown company from a hard to spell country and then touching things is universally safe. I miss the old "IANAL" tag which at least provided basic warning and self-awareness :-).
        altairprime 8mo ago
        IANYL, though! Offering legal advice with the disclaimer “I am not a lawyer” could be prosecuted as practicing law if a reasonably party could still infer a potential lawyer-client relationship from your message and/or intent. Instead, “I am not your lawyer” explicitly denies the lawyer-client relationship, which closes the door on both being accused of practicing law illegally and on being found as party to a lawyer-client relationship whether or not you have the appropriate certifications.
        technothrasher 8mo ago
        > closes the door on [...] being accused of practicing law illegally Does it? So I can say, "I'm not your lawyer, but I'm happy to go ahead and give you specific legal advice on your case." and I can't be accused of illegally practicing law? I was under the impression that this could still get you into hot water. But not being your lawyer, due to the fact that I am not a lawyer at all, I don't know if it is true or not.
        kstrauser 8mo ago
        IANAL, so take this with a grain of salt, but: As with all things, who are you going to get in trouble with? And what's so magical about legal practice as opposed to, say, giving shitty medical advice or telling someone how to build porch? Asking genuinely. No one falls all over themselves to say "I am not a doctor, but...", even though their next words could kill someone. The implication is that they don't have formal training but they saw something on Facebook that you should try. What happens next is on you, not on them.
  - ntoskrnl_exe 8mo ago
    I'm curious if this would really be considered unlawful access, since only pure idiocy and no hacking/scamming/etc were involved.
    - volkercraig 8mo ago
      It would be in Canada, but our "misuse of computer" charge is overly broad and never been well tested.
      - charlieyu1 8mo ago
        On the other hand, in Hong Kong it would be straight to jail. Someone was sent a link by the airlines, he changed a couple of characters and it ended up showing another person’s data. The guy voluntarily reported the vulnerability and all he got was a criminal charge and found guilty
  - tracker1 8mo ago
    You give someone ownership of something and they used that ownership...
    - krickelkrackel 8mo ago
      It's like leaving your bike in the street, with no lock. Still theft, but you'd be up for a part of the responsibility.
      - c22 8mo ago
        It's more like leaving your bike in someone else's garage.
      - tracker1 8mo ago
        No, it's like giving someone a set of keys to your car, and they take it for a drive.
        kstrauser 8mo ago
        I think it’s more like you registered the car in their name. Now they’re allowed to use it, and also responsible for the thing which they didn’t want. Consider that the “imposter” starts uploading child porn or something, and it’s on an account registered to your address. I think it’s perfectly A-OK to tell the service that it’s not me using the thing and I want them to close the account someone created in my name.
  - jama211 8mo ago
    No harm done no one is gonna prosecute this
  - cft 8mo ago
    In what jurisdiction? He's in Russia
    - AlexeyBelov 8mo ago
      He's in the US.
  - NikolaNovak 8mo ago
    Right. Techies are always quick to suggest I do something naughty or funny with this "great power" I've unwittingly gained, but in reality it's just a liability. If I ignore it and they do something nasty and implicate me, it's a pain. If I touch it with a 10 ft pole, now I'm even more actively involved. Just include "not me!" In the verification email, dam it
- delecti 8mo ago
  Have you tried sending them emails asking/telling them to stop?
  - kstrauser 8mo ago
    I’m a different person, but this happens to me, too. I have the kstrauser@yahoo.com email address because I signed up for it like 25 years ago. I log in every 6 months to see what the few other kstrausers in the world have signed me up for. Not jsmith, but kstrauser. Not Gmail, but Yahoo. And I still get banking docs, and HOA meeting minutes, and birthday party invitations, and Facebook logins, and other bizarre random stuff. I have so many questions. I’ve typoed my address before and had to correct it. That’s understandable. But to wholly invent one and say, yep, that looks good even though I’ve never used it before, I’m sure it’ll be fine! I just don’t get it.
    - Izkata 8mo ago
      I had one that person seemed to think their @twitter name was the same thing as my gmail address. Haven't seen it in a while, maybe they figured it out after I told their kid's teacher they had the wrong person...
    - josephg 8mo ago
      Yeah I have josephg@gmail. The amount of spam that account gets is wild - about 50-100 emails hit the inbox per day. I got soft-locked out of google docs a few months ago because my google account's 25gb quota was exhausted. Some of the emails are really unfortunate stuff. "Your account was added as a backup address." - Then inevitably, a few weeks later, dozens of password reset emails. Sorry bud. I've received pay stubs. Orders and invoices. I get phone bills every month for someone in India. Its chaos. Early on I'd sometimes reply to these random emails telling people they've got the wrong address. The most astonishing reply I ever got was from HSBC bank telling me I needed to come into the branch to change my email address. Over the course of a week, I explained about 3 times that that was impossible. That I live in Australia. That I'm not their customer, and its not my account. Eventually they told me they were disabling online banking on my account. Now I've given up replying at all. Send emails into that pit of PII misery if you want. I don't read them.
tecleandor 8mo ago
My Gmail account is a funny word in Spanish that I got when there was still plenty of names available. I get TONS of emails of people trying to join services that use my address as a "fake email".
- marcus_holmes 8mo ago
  We call this the Scunthorpe problem. Stupid "rude word" detectors use simple rules that fail on actual words. Way back I was working on a loyalty card system that had the entire UK electoral roll and Post Office data and we had to validate people; names and addresses. A "comedian" decided to sign themselves up for the system using a stupid name, and when the loyalty card duly arrived at their (correct) address with their (incorrect) name, they went to the papers and it became a slow news day human interest story. We had to implement a Scunthorpe filter, and that was really difficult. We ended up with a human looking at the data and hitting a button if they thought this was a made-up "funny" name or address. You would be amazed at English place names and surnames. Velvet Bottom is a real place in the UK. There are many people wandering around with names that you can't say in polite company.
-Fu 8mo ago
[dead]
parable 8mo ago
This happens to me several times a month. I'm more concerned about account termination, in that if their Gmail account is terminated for some reason, mine would be as well due to it being the backup email address.
ChrisMarshallNY 8mo ago
I have an "OG" mac.com account (got it about five minutes after Steve announced it). My wife actually has her first name. We both get hit with "OG Hell," where people are constantly entering our emails. I think most time, it is accidental (maybe they meant "XXX1234", and forgot the number). What makes it worse, is that Apple aliases mac.com, icloud.com, and me.com together, and there's no way to turn off one of the aliases. mac.com is really in retirement. No one sets up new ones, but the miscreants typo icloud.com, which gets routed to me. I have a rule, where I shitcan every mail to icloud.com, but I wish I could simply turn off the forwarder.
pocksuppet 8mo ago
You could try stealing theirs. Surely, one of the forgot-password flows must use the recovery email.

Romario77 8mo ago

I logged in several times to other people's accounts and reset their passwords. But it's too tiring, people keep adding my email. I hope it's because I have small simple email and not because they want to steal it.

nativeit 8mo ago
You’re confessing to several actual felonies here, may want to change strategies.
- kstrauser 8mo ago
  “…and so I made him the owner of my account, and he used that to remove himself from it!” “We’ll be right over.”
  - thatguy0900 8mo ago
    You forgot the part where he reset their email he didn't own and change their passwords so they couldn't get back into it
    - kstrauser 8mo ago
      I think you’re misreading this. OP has an email account. Someone else signed up for some website that doesn’t verify that you own the address before allowing you to log in and use the service. If the site did verify it, the user wouldn’t have been able to log in because OP would have been getting the verification emails, and not the user. Later, after OP told the user and they failed to change their address, OP logged into the site and changed their password, putting an end to the spam they were receiving from the user’s actions. I don’t have an ethical qualm with this. He didn’t want to sign up for the service. Someone else signed his email address up for it. Legally, I can’t imagine that being prosecutable.
      - NikolaNovak 8mo ago
        One thing I've found, occasionally the hard way, is that helpful bystanders are always offering advice based on "ethical", "intuitive", "logical" and "common sense", usually without any aspect of "legal". I got divorced a decade ago, and every well-wishing person in my life was strongly urging me to do things which were shockingly counter-productive / dangerous / wrong, based on their confident understanding (assumption, really) of the law which was completely and dangerously inaccurate. Hacker News audience is global. People start accounts for various purposes. Yet people still freely share the notion that logging in to some unknown website run by an unknown company from a hard to spell country and then touching things is universally safe. I miss the old "IANAL" tag which at least provided basic warning and self-awareness :-).
        altairprime 8mo ago
        IANYL, though! Offering legal advice with the disclaimer “I am not a lawyer” could be prosecuted as practicing law if a reasonably party could still infer a potential lawyer-client relationship from your message and/or intent. Instead, “I am not your lawyer” explicitly denies the lawyer-client relationship, which closes the door on both being accused of practicing law illegally and on being found as party to a lawyer-client relationship whether or not you have the appropriate certifications.
        technothrasher 8mo ago
        > closes the door on [...] being accused of practicing law illegally Does it? So I can say, "I'm not your lawyer, but I'm happy to go ahead and give you specific legal advice on your case." and I can't be accused of illegally practicing law? I was under the impression that this could still get you into hot water. But not being your lawyer, due to the fact that I am not a lawyer at all, I don't know if it is true or not.
        kstrauser 8mo ago
        IANAL, so take this with a grain of salt, but: As with all things, who are you going to get in trouble with? And what's so magical about legal practice as opposed to, say, giving shitty medical advice or telling someone how to build porch? Asking genuinely. No one falls all over themselves to say "I am not a doctor, but...", even though their next words could kill someone. The implication is that they don't have formal training but they saw something on Facebook that you should try. What happens next is on you, not on them.
- ntoskrnl_exe 8mo ago
  I'm curious if this would really be considered unlawful access, since only pure idiocy and no hacking/scamming/etc were involved.
  - volkercraig 8mo ago
    It would be in Canada, but our "misuse of computer" charge is overly broad and never been well tested.
    - charlieyu1 8mo ago
      On the other hand, in Hong Kong it would be straight to jail. Someone was sent a link by the airlines, he changed a couple of characters and it ended up showing another person’s data. The guy voluntarily reported the vulnerability and all he got was a criminal charge and found guilty
- tracker1 8mo ago
  You give someone ownership of something and they used that ownership...
  - krickelkrackel 8mo ago
    It's like leaving your bike in the street, with no lock. Still theft, but you'd be up for a part of the responsibility.
    - c22 8mo ago
      It's more like leaving your bike in someone else's garage.
    - tracker1 8mo ago
      No, it's like giving someone a set of keys to your car, and they take it for a drive.
      - kstrauser 8mo ago
        I think it’s more like you registered the car in their name. Now they’re allowed to use it, and also responsible for the thing which they didn’t want. Consider that the “imposter” starts uploading child porn or something, and it’s on an account registered to your address. I think it’s perfectly A-OK to tell the service that it’s not me using the thing and I want them to close the account someone created in my name.
- jama211 8mo ago
  No harm done no one is gonna prosecute this
- cft 8mo ago
  In what jurisdiction? He's in Russia
  - AlexeyBelov 8mo ago
    He's in the US.
- NikolaNovak 8mo ago
  Right. Techies are always quick to suggest I do something naughty or funny with this "great power" I've unwittingly gained, but in reality it's just a liability. If I ignore it and they do something nasty and implicate me, it's a pain. If I touch it with a 10 ft pole, now I'm even more actively involved. Just include "not me!" In the verification email, dam it
delecti 8mo ago
Have you tried sending them emails asking/telling them to stop?
- kstrauser 8mo ago
  I’m a different person, but this happens to me, too. I have the kstrauser@yahoo.com email address because I signed up for it like 25 years ago. I log in every 6 months to see what the few other kstrausers in the world have signed me up for. Not jsmith, but kstrauser. Not Gmail, but Yahoo. And I still get banking docs, and HOA meeting minutes, and birthday party invitations, and Facebook logins, and other bizarre random stuff. I have so many questions. I’ve typoed my address before and had to correct it. That’s understandable. But to wholly invent one and say, yep, that looks good even though I’ve never used it before, I’m sure it’ll be fine! I just don’t get it.
  - Izkata 8mo ago
    I had one that person seemed to think their @twitter name was the same thing as my gmail address. Haven't seen it in a while, maybe they figured it out after I told their kid's teacher they had the wrong person...
  - josephg 8mo ago
    Yeah I have josephg@gmail. The amount of spam that account gets is wild - about 50-100 emails hit the inbox per day. I got soft-locked out of google docs a few months ago because my google account's 25gb quota was exhausted. Some of the emails are really unfortunate stuff. "Your account was added as a backup address." - Then inevitably, a few weeks later, dozens of password reset emails. Sorry bud. I've received pay stubs. Orders and invoices. I get phone bills every month for someone in India. Its chaos. Early on I'd sometimes reply to these random emails telling people they've got the wrong address. The most astonishing reply I ever got was from HSBC bank telling me I needed to come into the branch to change my email address. Over the course of a week, I explained about 3 times that that was impossible. That I live in Australia. That I'm not their customer, and its not my account. Eventually they told me they were disabling online banking on my account. Now I've given up replying at all. Send emails into that pit of PII misery if you want. I don't read them.

tecleandor 8mo ago

My Gmail account is a funny word in Spanish that I got when there was still plenty of names available. I get TONS of emails of people trying to join services that use my address as a "fake email".

marcus_holmes 8mo ago
We call this the Scunthorpe problem. Stupid "rude word" detectors use simple rules that fail on actual words. Way back I was working on a loyalty card system that had the entire UK electoral roll and Post Office data and we had to validate people; names and addresses. A "comedian" decided to sign themselves up for the system using a stupid name, and when the loyalty card duly arrived at their (correct) address with their (incorrect) name, they went to the papers and it became a slow news day human interest story. We had to implement a Scunthorpe filter, and that was really difficult. We ended up with a human looking at the data and hitting a button if they thought this was a made-up "funny" name or address. You would be amazed at English place names and surnames. Velvet Bottom is a real place in the UK. There are many people wandering around with names that you can't say in polite company.

-Fu 8mo ago

[dead]

parable 8mo ago

This happens to me several times a month. I'm more concerned about account termination, in that if their Gmail account is terminated for some reason, mine would be as well due to it being the backup email address.

ChrisMarshallNY 8mo ago

I have an "OG" mac.com account (got it about five minutes after Steve announced it). My wife actually has her first name. We both get hit with "OG Hell," where people are constantly entering our emails. I think most time, it is accidental (maybe they meant "XXX1234", and forgot the number). What makes it worse, is that Apple aliases mac.com, icloud.com, and me.com together, and there's no way to turn off one of the aliases. mac.com is really in retirement. No one sets up new ones, but the miscreants typo icloud.com, which gets routed to me. I have a rule, where I shitcan every mail to icloud.com, but I wish I could simply turn off the forwarder.

pocksuppet 8mo ago

You could try stealing theirs. Surely, one of the forgot-password flows must use the recovery email.