Comment by arn | Hacker News Reader

Comment by arn | Hacker News Reader

Appears this is a non-issue. For those who have been following. Matt Langley (the person who "discovered" the issue) has been posting updates here:

http://namesake.com/conversation/mattlangley/i-just-accident...

Relevant post:

"It seems that the 'victim' had opened an account using an email address of mine, with extra characters thrown in, which Gmail ignores and accepts as the same email address, so it was gmail which uncorrupted the email address and sent the emails to me, not Paypal. I had previously reported an account set-up with fraudulent email address to Paypal many times in the past, but only yesterday noticed that the email address was different to mine, in a way which on any other email system in the world would be a different email address.

Cheeky bugger. I'm gonna have to ask them to close it down or at least change the email address.

but I guess I owe you all an apology" - Matt Langley

edit: someone else posted this too.

so, some commentary. This should have been verified before posting, as it has caused some trouble for people who delinked their account etc. That said, I understand the rapid news cycle of blogging, though with something this potentially serious, I would think it would need to be verified.

Side note, first time I'd seen Namesake and it's kinda cool. Wish I could search.

When you sign up for a gmail address, all dot variations of the email address belong to you. So if you have andzdroid@gmail.com, then emails to andz.droid@gmail.com will also go to you, and a.n.d.z.d.r.o.i.d@gmail.com will also go to you.

What happened to the OP is that somebody signed up using a variation of his email. Obviously, if I signed up at paypal with YOUR email address, you'd start receiving MY paypal emails.

There is no vulnerability. Only stupid people signing up with other peoples' emails.

he's receiving emails from a fraudulent account that was set up with his email address but with a "." in it. I can't see the vulnerability there but it is important to point out. Paypal should be aware that Gmail allows it. I just created 3 different paypal accounts with the three different email addresses that only differ by the position of the dot.

Yup. More importantly, they should verify email addresses at registration time and delete accounts which don't get verified.

Almost all other sites do this. It's simple best practice and it stops them spamming third parties.

I'm surprised PayPal doesn't already do this. (My account is years old, so I don't know their current practices for creating new accounts).

Twitter and Facebook both do.

Yup, that's about the size of it.

You can also tack on a +<anything> to your gmail. So if you have example@gmail, you also own example+foo@gmail, example+bar@gmail, and so on.

But there continue to be reports that GMail has some issues with the dots where andzdroid@gmail.com and andz.droid@gmail.com can be two different accounts:

http://www.google.com/support/forum/p/gmail/thread?tid=60cbf... http://www.google.com/support/forum/p/gmail/thread?tid=2d9f3...

This is just people that don't know how GMail works.

Quoting your first link:

> I receive internal business emails addressed to this other guy and when I email him back, it comes back to me.

It obviously will come back to him, because the guy is emailing himself.

completely OT:

> Side note, first time I'd seen Namesake and it's kinda cool.

This reminds me of convore. Does anyone know who was first?

Namesake is indeed kinda cool. I created an entry for a separate discussion:

http://news.ycombinator.com/item?id=2661165

Reply on news.ycombinator.com