Hacker News Reader

Comment by firesteelrain | Hacker News Reader

I had someone send me their entire credit report. Luckily I am not a scammer and I deleted it for them. They sent me an Amazon gift card to thank me for not stealing their PII.

I get DoorDash order notifications, Uber notifications, etc

I am not sure how they signed up with my email as I never got a sign up notification

Part of this also is because email / gmail is not case sensitive Jsmith@gmail.com is the same as jsmith@gmail.com. I see a lot of Jsmith vs jsmith (like how I actually use my email).

Nothing is getting stolen from me but not sure how this is actually working for people.

View on HN

>email / gmail is not case sensitive Jsmith@gmail.com is the same as jsmith@gmail.com

gmail is not case sensitive. email systems are allowed to be case sensitive, most choose not to be. This used to be an issue to deal with when pre-internet legacy email addresses (like Lotus Notes corporate email, or Outlook/Exchange systems) were put onto the internet.

Email systems are allowed to be within their own domains. If an email is sent from Yahoo.com to Gmail.com, case is irrelevant.

So, assuming case matters is foolish.

RDC 5321

> The local-part of a mailbox MUST BE treated as case sensitive.

> So, assuming case matters is foolish

Oh so much fun with my yearly quiz testing students about case-sensitivity! They're always wrong because thinks are so horribly broken.

It is absolutely foolish, assuming case _may_ not matter in the Internet. Case does not matter, true, except it does.

One of my favourite parts: URL paths are case-sensitive, except most servers do not care (because of a case-insensitive filesystem), and they're not always case-sensitive, e.g. for the mailto-scheme the path is case-insentive, because the path is actually an e-mail adress (which is itself case-insensitive).

Gmail also parses out periods in the address. j.smith@gmail.com will go to the same place as `jsmith@gmail.com`.

I have firstnamelastname@gmail.com and it surprises me how many other people have my same name. I get so much unintended mail, usually to firstname.lastname at gmail. I have found that in a lot of cases they have forgotten a middle initial. I usually let it go as spam unless it looks important like a credit card. What frustrates me is that these companies will not interface with me at all, sometimes not even leaving a note on the account.

I understand from the security side why they wont, but I wish there was something they could do. I could easily log in and change a password then cancel the account, but I figure there's probably some legal trouble if I did that.

I get credit card stuff and credit report stuff from bozos with similar nanes to me. I used to try to inform them, they won't let me. The worst are Experian, who won't let me interact with them at all, because I can't prove I'm the person or people who've been mistakenly using my email address.

You'd think that they would be willing to interact with someone sending emails from the same address they're spamming!

My stock reply to this used to be that you can send emails from anyone - who the email is sent from is not authenticated.

It's a little less true now with some of the newer protections, but only today I received a fairly subtle spam/scam supposedly from the main email address of a major retailer, so I think it's still sensible to never every trust the "From:" part of an email.

Sure, but they could just sent a link back to the same address with a form to fill out the complaint, or even just a phone number saying "call this number to speak to customer service about the issue you're having". From a technical standpoint, it's not hard at all to invert things to use the address as a recipient in a way that confirms that someone is able to access the email sent to it. A company like Experian that claims to have info on literally a billion people would be silly not to recognize that their scale is going to occasionally end up with mistaken contact info, so if they cared at all about the quality of their data, they would have some sort of system established to handle this.

This is an useful to know for websites that incorrectly mark the address as invalid for a '.' in the local portion.

Is this something you come across often? I always give the canonical spelling of my email, dots included, and can't remember a time when it wasn't accepted.

Reply on news.ycombinator.com