Hacker News Reader

Comment by andypants | Hacker News Reader

When you sign up for a gmail address, all dot variations of the email address belong to you. So if you have andzdroid@gmail.com, then emails to andz.droid@gmail.com will also go to you, and a.n.d.z.d.r.o.i.d@gmail.com will also go to you.

What happened to the OP is that somebody signed up using a variation of his email. Obviously, if I signed up at paypal with YOUR email address, you'd start receiving MY paypal emails.

There is no vulnerability. Only stupid people signing up with other peoples' emails.

View on HN

But there continue to be reports that GMail has some issues with the dots where andzdroid@gmail.com and andz.droid@gmail.com can be two different accounts:

http://www.google.com/support/forum/p/gmail/thread?tid=60cbf... http://www.google.com/support/forum/p/gmail/thread?tid=2d9f3...

This is just people that don't know how GMail works.

Quoting your first link:

> I receive internal business emails addressed to this other guy and when I email him back, it comes back to me.

It obviously will come back to him, because the guy is emailing himself.

You can also tack on a +<anything> to your gmail. So if you have example@gmail, you also own example+foo@gmail, example+bar@gmail, and so on.

he's receiving emails from a fraudulent account that was set up with his email address but with a "." in it. I can't see the vulnerability there but it is important to point out. Paypal should be aware that Gmail allows it. I just created 3 different paypal accounts with the three different email addresses that only differ by the position of the dot.

Yup. More importantly, they should verify email addresses at registration time and delete accounts which don't get verified.

Almost all other sites do this. It's simple best practice and it stops them spamming third parties.

I'm surprised PayPal doesn't already do this. (My account is years old, so I don't know their current practices for creating new accounts).

Twitter and Facebook both do.

Yup, that's about the size of it.

Reply on news.ycombinator.com