Hacker News new | ask | show | jobs
by nine_k 2687 days ago
This is delightfully crazy.

Give some random guys with no website your registration record somewhere, allow them to verify your registration as theirs, and then impersonate you, reset passwords, see any communications, possibly log in as yourself and do anything. All this with no recourse.

Nigerian spammers moan from envy for such a brilliant self-propelled gullibility filter.

9 comments

I have first.last@gmail.com and I've had people play poker and lottery and sign up for dating websites with my e-mail address. I've also received confidential information from insurance and building construction companies.

It's hilarious.

At this point I feel like I've shared a life with some of the others at this point. There are several people who share my name who continually give out my address. I get school closings, invites to pie socials at churches, family pictures, conservative newsletters, and much more.

Once I was told about "my" enlistment in the reserves of some armed service. That one I replied to and got a very polite response from someone with a little bit of rank.

ha! Same here. I was sent notifications from a military application once (seemed to be some SAP style system). I responded to a CCd email and they politely responded and corrected the address.

The others are more mundane. Mailing lists with dirty jokes from a group of american dentist friends. School notifications from a guy in the UK. Random baby pics.

Im not sure if there are lots of people with the same name who occasionally get their mail wrong. Or a few people with the same name who constantly do. It just seems weird though. Surely if you had a non firstname.lastname@gmail address you would take extra care to add in the extra padding.

People are stupid when not paying attentions.

I had customers who entered an undeliverable=invalid gmail address because they were confused about who hosts their email. Used foo@hotmail.com, entered foo@gmail.com. A few years back, I wouldn’t have thought this possible.

Me too-- a lot of receipts from Home Depot, little league, real estate documents (many times), scans from signing up for gym membership (which had a lot of PII in it, I called the guy), emails from a church elders group.

Once I got an advanced copy of remarks the UK Prime Minister was going to make the next day at the 2008 Jeddah global energy summit.

Same here. I've also received legal and tax documents, invitations to bachelor parties, draft scripts for motion pictures, medical records and offers to buy my multi-million dollar house in Florida (hint, I don't have one, but somebody with the same name does).
OnStar, some similar VW service, lots of phone contracts, legitimate job offers. I texted a guy once and asked him if he enjoyed his chipotle burrito.

It's bizarre. The people using "fake" gmail addresses don't seem to realize it is used by somebody else. They are lucky I'm not malicious.

Edit: mine is a first name and a number

I'm about 99.99% certain they are not using fake addresses but they simply don't properly know their own address.
Same. I once set up a google group to forward mail to the others. Limited usefulness.

World-class was the lady who sent me pics of herself in lingerie. Not too revealing and I deleted them immediately and replied to warn her. She nearly died of embarrassment.

I'm pretty sure there are spam lists who sign me up to products, probably for some kind of referral. I join all sorts of junk.

Compounded by Google making "first.last@" = "firstlast@"

Next Gmail account is going to be a guid.

A while back when Yahoo released inactive email addresses, I grabbed moore@yahoo.com. It was a nightmare. The account would receive 10,000+ emails a day. The inbox was full of insurance claims, social security numbers, mortgage applications, pay stubs, and more. In the end, I deleted the account since I didn't want the possible liability of the account.
I have tons of this. I really hope the gmail team is working on it. I don't get spam anymore, I get someone with a name similar, but not quite mine's receipt, dealership tune up reminders, directTV announcements, information about going back to get their RN, etc.

Like none of it is spam exactly, just a lot of wrong numbers.

I had a coworker who had the same name as a coworker in Phoenix as (we are in Boston). He kept getting invites to meetings out there because the online email was also a scheduling tool (notes). He was getting annoyed dealing with them. I suggested flying to Phoenix to go to one of these meetings...
I bribed an exchange admin or two and got [firstname]@[really big company].com. This company had a lot of consumer facing stuff, and some of which required an email address. Employees of the company would just put in [customers first name]@[the company].com when they didn't have an email address.

That was fun.

I thought I was the only one (with a firstlast@gmail.com) that kept getting confidential info from/for construction companies, dentists, and some Canadian woman.
(Firstinitial)lastname@ Gmail checking in.

So much misdirected email. Try to sign up for something? Reset password change info to not theirs.

It's amazing what people send rather blindly.

Me too, why do you think this happens? I get emails from people who send it to my exact email, I am not sure why they think this is their email (sorry don't want to disclose my email... but it might be in profile :) ).
XKCD has a comic about that experience: https://www.xkcd.com/1279
Me too! One of the others with the same name signed up for a dating website (match.com IIRC) a few years ago and they sent enough information that I was able to improve his odds and help a bit with his decision making.
I get a lot of updates on the kids (not my kids) from one specific person (I've responded to them, they keep doing it), and an occasional W2 (not my W2).
Interesting that so many people had a similar experience. I guess my name is literally unique.
It's no crazier than using any other disposable email service... if I'm registering an account at neopets.org or whatever I probably just don't care.
wow, sites like neopets.org still exists :)
I mean, either it doesn't or that's not the URL... I just pulled the name from a hat.
It’s http://www.neopets.com/

Wow they’ve been around for 20 years now, that’s not bad!

Dude who made it posted on /r/golang recently. Apparently his next masterpiece will be in Go :)
In that regard though, it's not different to existing throwaway email services. I'd use this sort of thing for registering for annoying things like "free" wifi.
Most free wifi hotspots don't verify your email fyi
To some extent, they can't. (How do you verify the email without being on the wifi?)
some may allow popoular e-mail services (and imap/pop3 ports) traffic, while blocking the others
other captive portals let user in, ostensibly to open inbox and click the link, then kick off the net if that didn't happen within 5 minutes.
I own a domain which a lot of people on the Internet like to randomly type in when they are signing up for things. It is ridiculous how many services accepted those fake email addresses over the years and therefor how many accounts I could reset passwords for.
What is it?
I don't understand what point you're making. Isn't that true of mailinator.com too? Have you never signed up for an account on a service you didn't trust not to spam you?
Unless you don't want an account. So many things require stupid email verification just to get at no transactional stuff like content.
and it pollutes the googleborg no less, by using a gmail account.

occasionally people (accidentally?) use my (long-in-disrepair) gmail account in this way, and it's amusing to see their little peccadillos. sometimes you get the devilish chance to change subtle details of an online profile =D

not to mention the damn google dot hack that still works with all gmail email accounts...
Not to mention the +something which gives you infinite email addresses.
If you are worried about your user details getting stolen after signing up with someone else's email-

You aren't using this service correctly.

The idea is to not give away your email or signup for a website, but get access to that website.

Yeah, my interpretation is that it's for situations where you would normally prefer to use a fake email (joeblow238998324@gmail.com) but can't because of the verify link.
I typically use a rando address @mailsac.com but then I have to take the 3 steps to visit, enable links, click links. With this tool, I'm saved those 3 steps. Keep in mind, this is strictly for throw-away accounts that require registration
Thanks for seeing the value, after releasing this I got to know some services require session authentication, so without your password (or cookies) the bot cannot verify.

I think this was a nice experiment and still usable for many services.

You could let people pass the username/password in as part of the email tag, like:

guerillaemail+myusername-mypassword@gmail.com

As others have clarified, only for complete throwaway accounts obviously. I tested '-' and '!' and those characters appear acceptable as the delimiter. ':' gives a very strange error on send when using gmail.com. Also imagine you'd lose some letter casing along the way.

Really just a fun and terrible idea!

As a reminder, site operators, this is why some sites require you to enter a user/pass to confirm a "verify link".