Hacker News Reader

Comment by sorahn | Hacker News Reader

I really wish that I could tell google to bounce all the emails that don’t match my “dot pattern”

I’m now in complete control of someone else’s commercial business hvac account because of precisely this problem. And the worse part is that I don’t know the correct email to get ahold of this person. They’ve set up library appointments, I received a receipt for a down payment on a lake house, basically most of this persons recent attempt to start a commercial business has been emailed to me.

I don’t want this email google. Please give us the option to make it stop.

View on HN

I'm now in complete control of someone else’s commercial business hvac account because of precisely this problem.

But that has absolutely nothing to do with the dots. Indeed, almost every comment about this has nothing to do with the dots, including the submission.

Someone entered the wrong email address, and in the process got yours. It isn't like the dotted or undotted one is legitimately theirs -- it can't possibly be -- but that they forgot a middle initial or something of the sort.

I've written about this before-

https://dennisforbes.ca/index.php/2016/04/08/email-addresses...

-but the issue is with email itself, and the notion that once someone enters an email address it is authoritative. Like you I get a tonne of email for other people. I get travel tickets. I get room reward points. I get calendar events for car service in England. The dots aren't the reason.

I strongly disagree with the author as well. Netflix is not doing its job.

But the scam described by the author works because he victim already has an account registered with their Gmail address.

The warning could be a good idea

also I wish the email address of both the recipient and emitter were shown in a better in Gmail.

The scam works because of Netflix's lax security practices around verifying emails. Given how easy it is to make a mistake filling in your email address, and email address should never be trusted until it is verified AND you should make clear during your sign-up process that the user should expect a verification email so they know something is wrong when they don't receive one.

But the author reset the scammer's password, denying them access to their fake account. The scam doesn't seem to work unless Netflix allows you to enter a new credit card number /without/ resetting the password of the scammer's account.

In the initial submission, without the dots issue though, the wrong address entered wouldn't be able to match an existing user.

That's why you send an email to whatever the user typed in with a link they have to click before they can complete the signup process. This is really, really basic stuff.

Yes, I agree. My point was just that the dots did have an effect in the initial submission story.

I agree there's that fundamental problem with the way email gets handled.

But at the same time I still wish Gmail would stop you from receiving emails on addresses other than the one you created yourself (ie by treating dots like any other character). It'd save me from getting several misdirected emails per day.

It's true that all these misdirected emails come down to people misremembering their addresses, but I think you're overlooking an important class of such misremembering (which can be addressed on its own).

I have a dot in my actual email address. There are several people who have a similar address who must be forgetting that their email address actually contains an additional initial or number. However some of these people do not have the dot in their actual email address.

I.e my email address: this.that@gmail.com

The other email addresses: thisnthat@gmail.com, thisthat7@gmail.com, etc

...where the other addresses get misremembered as: thisthat@gmail.com

I get these peoples' emails, but that could be easily avoided if Gmail took note of the dots.

I do this, using a Google Apps script to send any emails to unexpected addresses to Spam.

Something like this: https://stackoverflow.com/questions/24540743/how-to-spam-fil...

I have a concern with that. Say I train the filter to treat emails from company X as spam, and then in the future I sign up with company X and their emails to me get treated as spam.

I dont know for sure if that's how the filter would behave, though.

That same problem can happen even without dots. People can simply mistype their email and have it be your email. That happens if even if neither of you have dots in your email.

So then send the verification email at signup and any time the user changes the stored email on their account. Am I missing something?

I agree that's the answer. Unfortunately many services out there (including Netflix apparently) don't do that.

You’re not missing anything, but if gmail delivers all the mail, and I just trash it, we’ve fixed the symptoms, but not the problem, and we’ve made the problem invisible.

I agree that sending verification emails should be the standard. But if I can’t bounce the emails then there isn’t even the slightest way to inform the sending service that there might be a problem.

Do you also, by chance, have a short Gmail address? I've also definitely gotten signups from other individuals mistyping their address on my six letter account.

My comedy ownership of someone else's identity is a Staples account. Presumably someone in New York with a similar name had a store person look up their Staples account, which was actually my Staples account, and associate their business name with it. Their business name now appears on mailings I get from Staples and sometimes I get sample pens and the like branded with their business name.

It’s not too short. 12 characters including the name separating dot.

This person that recently started using this email is using the same name but with no dot.

first.lastname@gmail is what I use, and now I’m getting a bunch for firstlastname@gmail.

Some of these emails look pretty important too, if I had malicious intent, I could probably ruin and or steal this persons identity and or business with the specific mail that I’ve received recently.

I’m really amazed at the lack of confirmation of emails before sending things like your HVAC business license, or city contracting permits, that have other people’s identifying information in them too.

Wouldn't the same thing be happening if they'd entered first.lastname@gmail, or if you used firstlastname@gmail? It seems like the problem is that they entered an email address that wasn't actually theirs. The dots don't seem to make a difference.

Indeed, my wife gets this problem all the time on gmail because her name is a fairly common one. The dots don't enter into it in the general case.

Just create a filter to send everything that doesn’t match your dot pattern to the trash. I have a relatively common first name / last name gmail account and it gets out of control sometimes.

My issue with doing that is that the other person will never get help. They’ll just say “oh my emails keep getting lost”, but if google would bounce them, then hopefully one of these services would notify the person that that isn’t their email. Instead of them happily continuing to send it all to me.

Very few services manage email delivery well enough to propagate email bounces back to their user account info.

The amount of consideration I'm willing to extend to a person who either doesn't know their own email address or is trying to scam me isn't that great.

Sometimes I'll text the person and complement them on their choice of purchases- yesterday it was a stunningly large Domino's pizza order.

Don't see a way to do that in the web UI. There's a "To" box in the first page for filter setup, but no obvious way to negate so as to specify "NOT To".

You can create a filter on the “to” field of emails. Any email sent to the undesired dot pattern will have whatever action you choose taken on it. Put them in a folder and mark them as read or send them to trash.

You can (should) also mark the messages as spam because whoever accepted that address without verifying it shouldn’t be sending emails to it.

Something similar happened to me once [1] and I used the password reset process to "hijack" the account. I used that to contact them over facebook, and then assigned the account to their proper email address. They were quite grateful.

I'm not sure of the legality of that process, and you could argue the morality of it, but doing this once to one of their less important accounts (library?) might be a good way to get enough information to contact them properly.

[1] It wasn't technically the same, because the typo was done by a phone carrier agent, not the person whose account they were setting up. My email is firstname.unrelatedstring, theirs was firstname.theirmiddlename.lastname, but my unrelated string happens to be their middle name.

You may be able to set up filters to automatically trash everything sent to incorrect addresses. It might be fairly annoying, but it should certainly be possible. Just set a filter for firstlast@gmail.com to send them to spam. Also, software such as mailwatcher allows you to bounce emails after they've been received by the server if you think it necessary.

Can't you use the "report as spam" feature?

It would be nice if gmail's filters had "bounce" and/or "report as spam" as available actions.

Anytime this happens to me, I immediately log in and change the password.

They can work with customer service to get the email corrected.

I just tried creating an account that differed from an existing account in the number of dots, and it was refused, explicitly on the grounds that periods and capitalization are ignored. Therefore, either at some point Google got this wrong and allowed the creation of such aliases to an existing account as if they were distinct, or this person is mistyping one of the non-dot characters of their address.

Gooogle had a dots bug about 14 years ago and fixed it about 13 years ago.

People just mistype addresses and vendors don't verify

Obligatory XKCD: https://xkcd.com/1279/

I also combat with the same problem from time to time.

Reply on news.ycombinator.com