Gmail might partially be to blame for receiving emails from other Sean Conners | Hacker News Reader

Gmail might partially be to blame for receiving emails from other Sean Conners

boston.conman.org

32 pointsdmarto44 comments

I'm a bit skeptical Google ever treated `fname.lname@gmail.com` and `fnamelname@gmail.com` as different accounts.

I registered the `fname.lname` version very early on (before GMail was freely available), and while I do sometimes get emails sent to the `fnamelname` variant, which is consistent with someone having signed up with that variant, but is also consistent with someone just forgetting what their email address is (eg, they meant to type `fnamelname@hotmail.com`, or `fnamejlname`, or whatever). Especially since the mixups are very, veyr rare.

I can't rule out some weird collection of google bugs, but Occam's Razor suggests it's just an occasional typo. Especially until someone pulls up two screenshots of Google accounts showing colliding addresses.

My email is fname.m.lastname@. My last name starts with a vowel. There is another surname that is mine with a leading consonant which happens to be my middle initial.

There is an older man, late 60s I think, with that name. I receive his email at least once a month. I have received sensitive emails, and I could no doubt perform some sort of computer fraud with those. He is not forgetting his email and putting a period in between the first letter of his name and the rest of it.

The Google ecosystem is vast. Somewhere within that ecosystem is one or more components that strips and/or ignores the dots, and for that split second his email and mine are identical.

No, that guy really just doesn't know what his address is. There is no fname.mlastname@ account. You can verify that very easily by sending an email to that address. 100% of the time it will arrive into your account. Or you can try logging into it with your password.

In Google's account system, there's ~nothing you can do with just the username. You need a user id. The only way you can get a user id from a username is to call an RPC service to do the lookup. Doesn't matter whether it's for logging in, finding the account to deliver email to, creating an account, or whatever. Everything goes through that chokepoint. And that RPC server will always normalize the username at lookup time.

(I probably read that normalization code more often than anyone when working at Google on account security stuff, since that was the single place that had any reason to deal with usernames rather than user ids. That code was effectively immutable.)

Wait, what you're describing sounds like Gmail working exactly as documented. If I understand correctly, your name is something like John P. Smith, and there is also someone named John Psmith. You own john.p.smith@gmail.com, which means you also own every variation of that address created by adding or removing dots, such as johnpsmith@gmail.com or jo.hnps.mith@gmail.com. This of course includes john.psmith@gmail.com. It is entirely yours, and nobody else can have it. If someone gives it out as their own address, they are simply confused.

I registered my Gmail account very shortly after the invite-only public beta began, so my Gmail username is simply my first name (in this example, it would be john@gmail.com). Believe me, I know a thing or two about confused people giving out email addresses that don't belong to them.

Importantly, the dot-normalization rule was there from the very beginning. You learned about it alongside all the other kooky ways Google had decided to reimagine email, including 1 GB of storage, conversation threading, and an interface with a prominent "Archive" button but no visible "Delete" button.

I think you are correct. I am in the same boat. Consistently, if I send emails to myfirstnamemylastname@gmail.com they are delivered to me. Without fail. I too registered in the beta phase and I do not think anyone has an account without or with more periods than mine.

The type of messages I receive are typically one of things like hotel, reservations, e-commerce shopping receipts. Likely someone misunderstands the address or misses a letter in between. Maybe alerting everone from myfirstnameAmylastname… to myfirstnameZmzlastname@gmail.com helps them take better care.

I think there's a wrinkle here to do with @googlemail.com, which was the original domain name for users in the UK where 'Gmail' was trademarked by another company.

I've seen some fairly convincing evidence to suggest that different people have been able to register fnamelname@googlemail.com and fname.lname@gmail.com and, for them, the usual rule that you can add a '.' anywhere before the @ doesn't hold true.

My Gmail account is old enough that I needed a beta invite from a cooler friend. As a cool kid myself, I registered a name full of punctuation. For decades Google has treated the punctuated and unpunctuated addresses as one and the same. There is no distinct Google account that can be access via one username or the other.

I used to love watching the “unlimited” storage counter increase as each second went by

Both this post and the quoted one seem to be confused. Adding periods to a Gmail address never ever, since day one, went to a different mailbox.

I would like to see some of the evidence that two different people are logging in to accounts that are only different by periods.

I doubt that there are likely cases of people having joe.smith@gmail.com and joesmith@gmail.com as distinct accounts, but I would note that for other domains hosted via gmail, in my experience, joe.smith@example.com and joesmith@example.com, say, would be treated as distinct mailboxes.

It's always since day 1 been gmail's stance that this was intended behavior.

From the various reports, including by people aware of gmail's stance, gmail may have had a bug allowing it at some point.

> From the various reports, including by people aware of gmail's stance, gmail may have had a bug allowing it at some point.

I think these are simply people who cannot believe that someone might give out an email address they do not actually own, either because they are confused or because they make one up on the spot just to fill in a required form field. So when they receive messages intended for someone else but addressed to another variant of their own address, they treat that as proof that the intended recipient owns that variant. In reality, people giving out email addresses they do not own is extremely common.

I see a lot of people swearing up and down that they have seen proof that such a Gmail bug exists. But whenever you dig into the details, it turns out that all they have actually seen is emails intended for someone else arriving in their inbox. There is never any direct evidence that two people were able to register two Gmail addresses that normalize to the same canonical address.

As others said, I also believe this post to be wrong. There is simply no evidence of the double account thing. But as we are all now talking about incorrect gmail mails…

I paid 1.4€ or something on ebay back then for an invite and got a very common first.last@gmail.com, I’ve gotten everything, invoices, investment information, medical data, private photos, etc., though it has been getting better in the last few years, besides boring transactional mails and account recovery etc, I now only get such mails once or twice a year, used to be a monthly occurrence. Probably helped that I always wrote back and corrected those people ;)

I’ve been using Gmail since the first day it became available back in April 2004. I have firstname@gmail.com. My name is two syllables, and I specifically remember using another invite to try to register first.name@gmail.com. Google wouldn’t let me because it said the address was already registered.

I’m pretty sure the ignore the dot rule has always been there.

Yep, same here, since the beginning, I have a lot of people trying to email me at firstnamelastname instead of firstname.lastname and it's always badly addressed email, especially as there's someone who uses firstnamelastnameinitial, which is kind of a nightmare.

They've always had the "ignore the dot" semantics and it's sometimes even useful for testing, same as the plus-for-tagging.

On the plus side I did manage to save a name-cousin's immigration application one time when it went to spam on my account, I though that was a pretty interesting experience.

I also don't think google will let you actually register a new account without the dot, so the privacy leakage is much smaller than you might imagine.

As others said, this post is wrong. I’m another owner of first.last/firstlast since 2004. There was never a period where Google got the dots wrong.

People will forget their middle initial in their email (or others won’t notice it), or they’ll add firstlast as a recovery email or something.

Receiving other people’s email never stops being funny to me. Some of them are grumpy about it (especially the one who paid for and distributed “thousands” of poorly designed business cards.)

More have a sense of humor, and I’ve enjoyed getting to know a few of the other guys with the name over the years.

How do you find them? I also get there emails and would love to at least let them know

Either they email me as a test, or the person who emailed me has let me know his real email. In one case, I texted the guy because documents were sensitive and contained his cell.

I have a canned reply to these to try to get them fixed, so there’ve been many opportunities for someone to communicate back.

For almost 20 years i have received Ryan Spahn, an actor (his partner is Michael Urie of Ugly Betty & Apple TV's Shrinking) emails as we have the same name and very close Gmail addresses. I have received party invites, limo pick up details, gift card from his mom in law, movie tickets and tons of other personal things that at times make me panic like new airfare chargers for an airliner i flew on a month prior or 1800-flower invoices which i did business with them previously. I have called these businesses once or twice but now just ask him if this was his transaction.

For all your trouble I hope you are at least invited to the parties.

Yeah people sometimes set the recovery email. I always assume it’s an attempt at setting up some kind of trail relating their fraudulent account with mine in an effort to take it over through some later social engineering attack on an engineer somewhere and I always delink it.

There shall be none but mine on mine. I have received since day one, 2005 emails at my address meant for others. Their pay stubs, their tax forms, the prospectus for the apartments they want. If I feel like it, I warn them. If I don’t, it goes to the ether. That’s life.

Sucks that you won’t get your loan. Or notice that your bank needs you to fill in a form.

I have had first.last since the beta data and firstlast always comes to me when I test it out.

could it be that something changed after the beta? but something also changed much more recently I'm sure of it because it's become a huge problem for me recently!

people are using my email as their recovery email which I have no option to 'unsubscribe' from. someone signed up with chime (a US money sending service) which unless your in the US there is absolutely no way to contact them about removing your email. I ended up going through the bug bounty programme as a last resort because I was receiving all their transactions and even had their address! I've had graduation photos, blood test results, shipping confirmations, beautician appointments, wedding planning (I had to email the vicar in the end and let him know I wasn't the bride being rude!) I get emails from a primary school and I'm invested in the receipts from a garden centre every few weeks though, they have quite a few rewards points now, they're working on their lawn at the moment and the other month they bought two jellycats!

At first I thought it might be someone whose email was at ymail.com but I'm not sure anymore it seems it's not linked to any one country or person either.

This reminds me of why I'm very nervous I've been able to login to LinkedIn by just click an email LinkedIn sent me; and to someone else's Netflix account from an email that was sent to me by mistake.

You _could_ blame the users for not setting up 2FA. But two wrongs don't make a right, and these websites should always ask for another means of authentication, even if it's just a password. Url parameters in links don't count.

I have a firstname.lastname@gmail account and sometimes get emails for firstnamelastname@gmail too. Mostly, it’s accounts being setup using that address then ending up in my mailbox. I assumed they were typos but, if I’m reading this blog correctly, is Google leaking emails from the other account into mine? If that the case, I’m pretty alarmed, as I use my Gmail for a lot of my accounts. Back to Hotmail, I guess?

There's no other account. The period is disregarded. When you sign up for foo.bar@, you effectively get foobar@ and all the other variations (foob.ar@, etc). No one else can sign up for these. Quirky but not terribly interesting.

That was my understanding all these years. Glad it’s still true.

Two comments on the referenced stackexchange [1] claim that very early gmail accounts with and without dots were distinct. But searching the web, and reluctantly asking AI, I can find no reference to this so I believe they are mistaken.

According to Google themselves dots never mattered, not even in 2004.

1. https://webapps.stackexchange.com/questions/14668/why-does-g...

Unfortunately, for me the example emails given in that answer get redacted by an injected Cloudflare script

The two email addresses that you mentioned are for the same account. Google has always ignored the periods. You can actually put those periods anywhere you want. You will get all emails to all variations of that address.

That is the claim, yes.

But no evidence has been presented, and it feels very unlikely to me.

I also have a firstname.lastname@gmail address from many years ago and quite often get emails for about five different people (based on the real-world location info in them). It seems that most of these are really sent to firsnamelastnamenumbers@gmail and somehow the number(s) get truncated by the sender, leading to firstnamelastname@gmail which then gets routed to me.

What leads you to believe they're being sent to firsnamelastnamenumbers@gmail? And by "sender" do you mean the human at the keyboard sending the email, or their email client? I can see how a human might forget to type the numbers, but not an email client arbitrarily truncating them.

Happened to me. The attached PDF had firstlast1@gmail.com but it was sent to firstlast@gmail.com.

Do you mean firstlast1@gmail.com was shown in the PDF? That may just mean somebody forgot to type the numbers when they sent the email.

I experienced this periodically on my gmail and always assumed that it was just a typo on the part of the sender, adding a period where there shouldn't be one. But there were cases that kind of defied plausibility, like when a recruiter (sharing my name but not my gmail address) sent out a mass cold email and I got the angry replies. I never figured out how that one happened, maybe they misconfigured their mailer software's replyto?

I never once considered that a gmail bug or intentional design decision could be at work there. TIL that they decided to cut down on the confusion by normalizing addresses.

Is it possible that the recruiter set up a faulty reply-to header, instead of sending from your email address?

I appreciate your reference to RFC-5321. I agree that "the local-part MUST be interpreted and assigned semantics only by the host specified in the domain part of the address."

However, in practice, there exist many services which have GMail's logic baked-in. Or worse, they get overzealous/underzealous with validating the email.

For example, you decide to sign up for e.g. Netflix as alice@gmail.com, which is the address for a Google account which you own completely.

There exists a small edge case where you want a second Netflix account, so you could do that by also registering alice+netflix@gmail.com. Or a.l.i.c.e@gmail.com. In that case, all the emails to these 2 addresses will be directed to the 'main' alice@gmail.com, as you might be aware of. So you'll get messages for more than one, separate Netflix accounts on the same inbox.

I'm not sure if they had this "plus aliasing" from the beginning, same as their logic with the dots.

When I say that there exist many services which have GMail's logic baked-in, I mean that certain apps will forbid you from registering again as alice+asdf@gmail.com or even a.l.i.c.e@gmail.com, because they want to stop on person from 'exploiting' multiple accounts (though Netflix is not one of them).

It is indeed important to go back to the RFC and understand what you are pointing out:

i.e. That, even though GMail redirects messages from both alice+asdf@gmail.com and a.l.i.c.e@gmail.com to plain old alice@gmail.com, it doesn't make it standard behavior, and this is likely not the case for your home-brewed mail server or your enterprise exchange server, which may treat those as separate inboxes, and this can lead and has led to unintended consequences.

I've been involved in the QA of a system which handles payments for a telecommunications provider. It's very common for the customer to land on a payment page, where he essentially clicks on a link, his telecom's account information is pre-filled, like his email address, phone number, and payment amount, and the customer just has to fill in payment information. So even though the telecoms provider can (and in some instances already has) saved a customer's email with a plus sign, the external payment processor's portal mangles it during parsing, converts the plus signs to a space, and then complains about a malformed URL.

As always, this gets filed as out of scope.

This blog is wrong. Other Sean Conners are to blame for not knowing their own email address. I know this because every other first initial j, last name chaney on this planet is a moron. I get Jennifer's receipts, Justin's bills, John's rent-2-own upcoming bill notifications, and hundreds more. Please. Make. It. Stop.

This is why I never use Gmail. All the spam filters in the world won't stop other people's emails from reaching me. (Oh, and Google's spam filters are pretty bad: they routinely route messages to the spam folder, even when they come from addresses I've corresponded with. It may be a DKIM/DMARC/SPF issue, but you would think that an incoming response to an email I sent would have a low spam score, even if the sender's mail server isn't configured 100% perfectly.)

You can have a space in an email address. On a project I was working on at a company I was at in 2003, I had to fix our support for that a number of times because that's what one of our customers had.

I have also been getting email in my Gmail account which are clearly unrelated to me. Some are very sensitive, related to bank account and mortgage. Tried letting google know with no success.

It's not Google's issue, it's (other) user error, those folks think their address is x, although x belongs to you instead.

I remember IBMs domain system being particularly well designed to ensure emails didnt go to the right place.

I used to cop a lot of emails intended for first.last@ca.ibm.com to first.last@au.ibm.com.

Senders got lazy, selecting the top most user alphabetically from the list, and then I popped up and just... never changed their behavior or habits.

Would have been less concerned if the canuck version of me wasn't embedded in like a bank or something, and I was embedded with a completely different customer account.

Took it to management when I got "Hey are we good for the firewall to come down ahead of the pentest to <bank> next week" and they did nothing about it lmao.

Nope.

Reply on news.ycombinator.com