The dots do matter: how to scam a Gmail user

Re:The dots do matter: how to scam a Gmail user by slx26 on Sunday April 08, 2018 @02:06AM (#16784852)

Agree that many steps can be improved. In real live, though, it's not so difficult to guess/find someone who has Netflix, and also find their email. That's a really weak security requirement, security shouldn't depend at all on that part (it seems more relevant for privacy to me)

[ Parent | on HN ]

Re:The dots do matter: how to scam a Gmail user by pryce on Sunday April 08, 2018 @04:52AM (#16785287)

Further, it is trivial to picture an attack where through some other channel, the attacker already knows the email address of their target, and has the knowledge that this victim has a netflix account.

If I only need these two pieces of information, neither of which is intended to be 'secret', then I might easily already have enough information to attempt this attack on (for example) my ex, or their new partner, or someone at either work or university that I dislike, even if I didn't have enough information to target a random person in another country.

It is good practice not to expose user's email addresses to attackers. It is breathtakingly bad practice to depend on those email addresses being secret.

[ Parent | on HN ]

Re:The dots do matter: how to scam a Gmail user by pttrpttrwttr on Sunday April 08, 2018 @05:45AM (#16785406)

I really don't see why Netflix needs insider knowledge or whatever to be able to detect john.doe as being the same as johndoe.

[ Parent | on HN ]

Re:The dots do matter: how to scam a Gmail user by SlowBro on Sunday April 08, 2018 @07:04AM (#16785582)

I believe it’s because this feature is largely unique to Gmail? So Netflix would need to know and maintain a database of rules based on domains.

* Gmail: Dots are cool.

* Hotmail: No capes! I mean dots. No dots!

* Multiplied by 8 hundred gazillion domains...

[ Parent | on HN ]

Re:The dots do matter: how to scam a Gmail user by DataWorker on Sunday April 08, 2018 @10:00AM (#16786088)

You’re thinking too much like a programmer. It’s a single rule for a single domain that accounts for the majority of users.

The right thing to do is ask for a password, but absent that, accounting for gmail addresses seems worthwhile. It would save them getting a thread like this on hn.

[ Parent | on HN ]

Re:The dots do matter: how to scam a Gmail user by patcheudor on Sunday April 08, 2018 @11:07AM (#16786429)

No database needed, just ask for e-mail validation by sending an account validation link to the e-mail. Problem mostly solved.

[ Parent | on HN ]