1

I cannot determine if my Gmail account is hacked. I am receiving spam from xx.yy.@gmail.com which is identical to my own Gmail address xx.yy@gmail.com except for the dot before the @. How is that possible since the dots are irrelevant to Gmail?

  • I have tested this situation by using the spammer's email address of xx.yy.@gmail.com to sign into my own Gmail account
  • Gmail labels the spam as coming from me, and they are received in the spam folder. In my inbox, in the "from" column, it says the emails are from "me", it uses the word "me", Gmail only uses the word me if I send an email to myself.
  • I am only referring to the email address inside the < >, not to anything outside it.
  • This problem has nothing to do with my previous questions which I posted approximately four weeks ago, since I had the Microsoft account at the center of those questions blocked and deleted by Microsoft (I assume), however, it could be a clue as to how today's problem may have been done, by using ........
schroeder
  • 129,372
  • 55
  • 299
  • 340
number8989898989
  • 11
  • 4
  • 3
    Anyone can set sender field in the email to any email address they want. That's why if an email looks like sent from your address, it does not mean anything. – mentallurg Apr 16 '23 at 19:47
  • I am only referring to the email address inside the < > , not to anything outside it – number8989898989 Apr 16 '23 at 20:09
  • Are you saying it's common for hackers to send email using other peoples email addresses without actually accessing their account – number8989898989 Apr 16 '23 at 20:15
  • 2
    No, I am not saying anything about attacker. I am saying, anyone can do that. The fact that Gmail puts such emails to the spam folder indicates that this is just spam. There is no indicator that your account was hacked. You can change account password, and I think you will continue receiving such emails, which will confirm your account is not hacked. – mentallurg Apr 16 '23 at 21:01
  • In the web version, in the context menu of the message select "Show original". Then you will see, from what server has Gmail received the email. – mentallurg Apr 16 '23 at 21:05
  • Similar questions were answered many times on this site. See this question, for instance. – mentallurg Apr 16 '23 at 21:11
  • In my inbox, in the "from" column, it says the emails are from "me", it uses the word "me", Gmail only uses the word me if I send an email to myself – number8989898989 Apr 16 '23 at 21:25
  • In the "Show original" of these spam emails that appear to be from my Gmail address ( even though I have no experience or education in reading that data ), it seems Gmail has received these three emails from three different servers, a different server for each one – number8989898989 Apr 16 '23 at 21:40
  • 3
    Gmail uses word "me", because the the field "from" contains your email address. As I said, the sender cans set this field to any value, including your email address. – mentallurg Apr 16 '23 at 22:05
  • I didn't actually know about this, so it looks like email is about as secure and reliable as postal-mail, the strange part is that they inserted that extra dot "." in the email-address as detailed in the question, when in fact it is not necessary to do that – number8989898989 Apr 16 '23 at 22:06
  • An email is just like a letter. Under normal circumstances, only you can access your mailbox, but everyone can just write your adress as the sender on any letter and send it to whoever they want (including to you) – UndercoverDog Apr 17 '23 at 00:16

1 Answers1

1

Emails are a VERY old protocols (SMTP). The fundamental securities of emails have not changed since its inception (read: no security).

I've worked on the behind-the-scenes format of email, and literally anyone can put in anything; it's just all plain text. I can put the "from" with anything I want.

There are practical strategies to deal with the lack of security. The mail servers will include information about where the mail came from. If the email is "from" your "myself@gmail.com", but it was sent by the server "@badserver.com", then this raises suspicion, and would probably get rejected or flagged as spam. Also, if you use a reputable email service, they do not let you arbitrarily change the "from" address, but anyone with a domain can setup email servers (it costs effectively nothing to do this).

There are also a lot of security in place behind-the-scenes regarding whitelisting, server reputation, spam detection, etc., but all this is not relevant to the current topic.

Nelson
  • 1,029
  • 8
  • 12
  • This question I have posted made me think about a possible type of solution that these webpage-based-email-services like Gmail could use, that would be that before sending the email your Gmail-signed-in-webpage would first send some type of mini-message to central Gmail-servers telling them that your Gmail-signed-in-webpage is about to send an email that using some algorithm results in some type of code/number/don't-know, so when they receive the email it has to result in the same code/number/don't-know that was in the mini-message sent just before the email.
    • – number8989898989 Apr 17 '23 at 02:39
  • I assume that obviously there are all sorts of solutions. – number8989898989 Apr 17 '23 at 02:39
  • You already can't enter an arbitrarily "from" field in a web-based email service because there's no good use-case for this, so they don't let you to begin with. Best to just read up on the specification if you're interested. If you don't understand the specs, then just leave it to others to deal with it. – Nelson Apr 17 '23 at 03:04