Hacker News Reader

Comment by Duff | Hacker News Reader

I think that the root of this issue is the stupid Google policy of not distinguishing any variation of your address if a '.' character is in there -- until someone registers it. People get confused and try to login.

So if your address is jsmith@gmail.com, you can send email to (or login with) j.smith@gmail.com or jsmit.h@gmail.com.... at least until someone registers jsmit.h@gmail.com!

I was an early beta GMail user have a reasonably common first initial last name GMail address. I probably get 3-5 password reset attempts per month. I also routinely received a variety of interesting misdirected emails. Everything from someone's VPN credentials, a US military EEOC complaint, invitations to a stag party in Ireland, a video of a paratransit bus flipping over (intended to be sent to an investigator), to girls modelling underwear for boyfriends.

View on HN

False. It is not possible to register multiple variants of the same address. The reason you get misdirected email is because people are entering the wrong address in forms. You should see all the email that goes to paul@gmail.com :)

Out of curiosity, is it enough to make the account unusable? Do you have to set up strong filters?

On an (un)related note, my google voice phone number is (xxx)-234-5678, and it is completely unusable. You should hear the kind of voice mails that I get. I have started archiving the most amusing ones in my account. I have been blocking the numbers from area code (xxx) since I registered that number (June/2009), but it is still not usable.

Do share. That sounds like a blog post waiting to happen.

With Gmail, j.s.m.i.t.h@gmail.com is the same address as jsmith@gmail.com as j.smith+nospam@gmail.com - it's likely that someone's mistyping their own email address all over the Internet (this happens to me all the time, having a common first name/last name combo. I get bills and newsletters and etc. Never got an underwear pic, though, alas!).

Good thing to remember this when writing a system that compares email addresses--always normalize Gmail addresses on the backend before processing--but woe betide you if you normalize on the frontend, people love their dots!

> So if your address is jsmith@gmail.com, you can send email to (or login with) j.smith@gmail.com or jsmit.h@gmail.com.... at least until someone registers jsmit.h@gmail.com!

Uh, if this is true it's a security abomination. I'm pretty sure Gmail doesn't allow registration with a login that would be considered the same as an already registered one (but I'm too lazy to check a few to confirm, just because I refuse to believe Google could be that dumb).

I just tried logging in with a random '.' in my username and got in.

That doesn't actually contradict what the guy I responded to said though; you'd want to try signing up for gmail with a few variations of your own login that have a few random extra '.'s. My assumption is that these would all be rejected due to the fact that the canonicalized version (all lowercase and with all periods removed) matches the canonicalized version of a currently registered login, but this guy was saying that's not the case.

But anyway, paul responded so it's a moot point.

You can also send a email to a gmail address with dots in it so sending a email to john.smith@gmail.com can be received by johnsmith@gmail.com, john.smi.th@gmail.com, etc. and vice versa.

Really, that works (surprise, not incredulity)? I have a period in my gmail address, but have never tried that. Seems like a very strange default.

Reply on news.ycombinator.com