Hacker News Reader

Parent Full thread

Jerrrry

Not an exploit, it is intentional, and ironically, is a countermeasure against phishing.

We all dread the day our Gmail password stops working, but this is what we signed up for.

I know my gmail is safe, because I know that without the password, not even I can get into it.

This is by design.

View on HN

Indeed, it's a publicly documented feature: https://support.google.com/mail/answer/7436150?hl=en#:~:text....

> is a countermeasure against phishing

How can it prevent phishing?

Taking a guess - If your Gmail address is larrypage@gmail.com - it prevents someone creating a completely different Gmail address like - larry.page@gmail.com - and using it to impersonate that other account.

I think it's complete conjecture that it's meant to be some kind of anti-phishing method - the solution there is just removing the ability to create addresses with periods - but I guess this way has some kind of utility for users?

Reply on news.ycombinator.com