Ask HN: Any one getting other people's emails in Gmail | Hacker News Reader

Ask HN: Any one getting other people's emails in Gmail

19 pointsx005419 comments

For about a year now I have been receiving other people's emails in my Google Apps email account. These are not spam emails, or misaddressed emails, these are emails that are clearly addressed to other people with completely different email addresses. It appears that the intended recipient also gets a copy of each email as sometimes I see back and forth conversations. I always delete these, and the volume is about 1 email per week or so. But what worries me a lot is, if I am getting other people's emails, what if other people, perhaps evil people, are getting my personal emails as well?

I contacted Google about it several times and got no response. This sounds like the sort of thing they really should look into, but I don't now how to reach anyone there. Anyway, I was wondering, has this ever happened to anyone else?

View on HN

Yeah I do get other people's email, but it seems to be more the sender's mistake than gmail's. My email is samuel.le@gmail.com, and people seemed to have been wanting to reach Samuelle <something> (Samuelle is a first name), Samuel Le <Something>, Samuel <something> Lee, etc. So far I've received an email from a sales person in a bank in Hong Kong offering me to buy some commodities derivatives, a non profit organization that takes care of mentally handicapped persons, a mover in the US, someone else flight ticket confirmation, some stuff written in Hebrew by a Rabbi, and many more...

When the mail seems legit I reply to the sender explaining they sent it to the wrong person, and often they apologize. It happens roughly every month/two months so it's not a major annoyance and so far I haven't received anything super confidential or personal.

"Gmail doesn't recognize dots as characters within usernames, you can add or remove the dots from a Gmail address without changing the actual destination address [1]"

Your email adress is samuelle@gmail.com and not samuel.le@gmail.com

[1] https://support.google.com/mail/answer/10313?hl=en

Yes, the dot is completely optional, and I think it's one reason I got emails for other people. Senders wants to email to samuelle.something@gmail.com, somehow mistake it to samuelle@gmail.com and I end up being the recipient.

There is not really any connection between what is in the From/To/Cc headers of an email and where the email was actually sent from or to. For example, I just sent an email to my own GMail account and put "foo@example.com" in both the From and To headers. Here is a slighly obfuscated log of how I did it:

  mike@flan:~$ telnet gmail-smtp-in.l.google.com 25
  Trying 2a00:1450:400c:c01::1a...
  Trying 74.125.71.26...
  Connected to gmail-smtp-in.l.google.com.
  Escape character is '^]'.
  220 mx.google.com ESMTP s83si999899wmf.10 - gsmtp
  EHLO whatever
  250-mx.google.com at your service, [*.*.*.*]
  250-SIZE 157286400
  250-8BITMIME
  250-STARTTLS
  250-ENHANCEDSTATUSCODES
  250-PIPELINING
  250-CHUNKING
  250 SMTPUTF8
  MAIL FROM:<foo@example.com>
  250 2.1.0 OK s83si999899wmf.10 - gsmtp
  RCPT TO:<*****@googlemail.com>
  250 2.1.5 OK s83si999899wmf.10 - gsmtp
  DATA
  354  Go ahead s83si999899wmf.10 - gsmtp
  From: <foo@example.com>
  To: <foo@example.com>
  Subject: Hello World

  Hello
  .
  250 2.0.0 OK 1467538374 s83si999899wmf.10 - gsmtp
  QUIT
  221 2.0.0 closing connection s83si999899wmf.10 - gsmtp
  Connection closed by foreign host.

Google even accepted that email and delivered it. Even after Google forwarded it on to my non-Google email address, it still had "foo@example.com" in both the From and To headers. It does not have my GMail address in there at all.

I'm surprised google accepted that email actually. Seeing as it outright hard-failed SPF checks. example.com makes a pretty clear statement in their SPF record that it should never ever be used to send email ("v=spf1 -all")

While what you say is totally true, but none of these emails are fishing emails, spam, or anything like that. It's just normal people emailing each other about home repairs, dinner, etc. The latest one was a LinkedIn password reset email, a real one, not a fake one. It was sent to an email address that looks nothing like mine.

Would you be able to provide the full raw headers for one of these emails?

Yes, I get this a lot as well.

My email is <first initial><last name>@... and another, actually multiple people, with the same first initial and last name, but different first name appear to be confused.

I receive real estate related emails for one person and credit card statements for another. I have attempted to report this to the CC company, but they require me to log in (to this user's account which I don't own with a company I don't have my own CC with) in order to create a ticket. It's been going on for over a year but I've been unable to get them to stop sending them to me. I guess they never considered this use case.

In first-time cases I often reply when it involves a third party to kindly let them know. I also filter aggressively.

That said, it seems too obvious a person could not know their own email address these days. Sometimes I wonder if these are stealthily designed target attacks of social engineering. One reason I never click the links.

I do have several people around the world giving out my email address as theirs. I get all sorts of weird email.

I also have this happening to me.

I get texas dmv emails and sometimes signup emails from websites.

Especially if you have a short handle like firstname@gmail.com.

Yes.

This is one of the reasons why I wish Google implemented aliases for accounts anchored to a UID instead of requiring a persistent user account name. This is how Microsoft does it, actually. Then there might be a way to control for accounts that have similar names.

Once I created a private google doc containing my business idea, I saw that very same text when I searched for my business name.

Thankfully Google showed only the first few lines in its general search. There is some data leak in Google. Its so big, something like this can happen.

Are you CC'ed or BCC'ed to it?

Very likely.

> ... Gmail strips the BCC recipient(s) from messages. The message is sent to the BCC recipient, but the BCC recipient is not displayed in the saved sent message. (The BCC recipient is also not displayed on Gmail's web-based interface if the message originated in Thunderbird.)

https://support.mozilla.org/en-US/kb/thunderbird-and-gmail

This could be the case, but I do not know any of these people, their names and emails are nothing like mine, and all of these emails are not spam, just people talking to each other about home repairs or the latest one was a LinkedIn Password reset email.

I can't see it in the headers, it's possible, but unlikely.

Does your email have a dot in it? Gmail has a bug, if I recall correctly, where people would get email from addresses with the dot stripped (eg a.b@gmail.com would get email from ab@gmail.com)

I myself regularly receive email that appears to be a result of this bug.

I have never seen a fix.

It's not a bug, it's a feature. This way people won't fake being you by creating an account with a dot in the user part of the email address (at least that's the way I see it eventhough I've never seen an official reason)...

https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-mo...

Fascinating. Except I created Gmail accounts with '.' in them and now get email intended for the Gmail accounts that do not.

Interesting reference, thanks. I'm guessing my account was created before intended restrictions came into play.

Reply on news.ycombinator.com