Hacker News Reader

> So if your address is jsmith@gmail.com, you can send email to (or login with) j.smith@gmail.com or jsmit.h@gmail.com.... at least until someone registers jsmit.h@gmail.com!

Uh, if this is true it's a security abomination. I'm pretty sure Gmail doesn't allow registration with a login that would be considered the same as an already registered one (but I'm too lazy to check a few to confirm, just because I refuse to believe Google could be that dumb).

View on HN

I just tried logging in with a random '.' in my username and got in.

That doesn't actually contradict what the guy I responded to said though; you'd want to try signing up for gmail with a few variations of your own login that have a few random extra '.'s. My assumption is that these would all be rejected due to the fact that the canonicalized version (all lowercase and with all periods removed) matches the canonicalized version of a currently registered login, but this guy was saying that's not the case.

But anyway, paul responded so it's a moot point.

You can also send a email to a gmail address with dots in it so sending a email to john.smith@gmail.com can be received by johnsmith@gmail.com, john.smi.th@gmail.com, etc. and vice versa.

Reply on news.ycombinator.com