0

Note: This is based on a true story!

The Story:

Alice and Bob are good friends and each one knows the personal email address of the other person and they contact with each other using it. Let's assume they are bob@example.com and alice@example.com for Bob and Alice, respectively.

Bob is a member of an online community (i.e. such as a forum) and he has put another email address of him, say carol@gmail.com, on his profile so that other users can contact him using it (that online community does not have a built-in message system for the users to contact with each other). Further, Bob has setup bob@example.com as the recovery email address of carol@gmail.com. And he has not (intentionally) put any other personal information on his profile that says this account belongs to Bob.

Alice knows that Bob is a member of this online community, however she doesn't know which account belongs to Bob. She suspects that this profile with the email address carol@gmail.com on it belongs to Bob, but she is not sure of it. In order to confirm her suspicion, she comes up with this plan:

She goes to Gmail website, enter carol@gmail.com as the email address and presses Forgot password? button. Then the following message is shown:

To get a verification code, first confirm the recovery email address you added to your account: "b********@example.com"

She enters bob@example.com and then the following message is shown:

Please enter the verification code sent to bob@example.com ...

That's it! She finds out that the account and email address belongs to Bob. She gets very excited and sends the following message to carol@gmail.com as a result:

Ha ha! EXPOSED!

The Question:

Well, Bob is very furious at this. He argues that he has followed all the security guidelines and he has tried hard to not expose any of his personal information and identity. Rather, he blames email provider (i.e. Gmail) and says that they should have designed the account recovery mechanism such that it protects the identity of the person behind the email address.

On the other hand, Alice, at the same time being proud of her ingenious plan, thinks that in this case there is an inevitable trade-off between convenience and security. She says that Bob has setup the recovery email so that he does not worry about his password being forgotten by him, and in turn this has the side effect of revealing his identity.

Who is right here? If you think Bob is wrong, what should have he done to both secure his identity and his email (i.e. keep it recoverable)? And if you are on Bob's side and think it is the email provider's fault, how should have they implemented the recovery mechanism?

Further, note that I am not insisting that only one of the parties is right and the blame is on the other side. It might be that both parties are wrong or right as well. If you have other viewpoints, I would be glad to hear them.

  • You have not set up a proper dichotomy. Both parties can be correct. – schroeder Nov 30 '18 at 15:35
  • The level of the controls was not what Bob needed to accomplish his goal. But the level of the control is appropriate for the classified threat that was identified by the email provider. Security is not all or nothing. Controls need to be in line with the threats. Bob's threat's were bigger than the email provider's controls. No failures on either side. – schroeder Nov 30 '18 at 15:39
  • @schroeder Thanks for your comment. First and foremost, I must say that I am not a security expert at all. I am writing this from the viewpoint of completely normal users and their presented arguments (in real word). If you think that both parties could be correct I would appreciate if you could give your reasons as an answer or a comment. Additionally, you may add other viewpoints as well. – today Nov 30 '18 at 15:39
  • Bob has linked an account which he wanted to be distinct from his main identity to his main identity. The mail provider provides a means of these being distinct - you create two accounts and use each as the other's recovery address, but where both are associated with the new identity. – Matthew Nov 30 '18 at 15:43
  • Question: if prompted to enter the email address for b*****@example.com, if Alice were to enter "barbara@example.com", would the system respond in the same way and prompt for the verification code sent to barbara@example.com? That would be a more secure way to respond but I'm not sure whether that actually happens. – Ben Nov 30 '18 at 16:33
2

Who is right here?

Both Bob and Alice are correct.

[Bob] blames email provider (i.e. Gmail) and says that they should have designed the account recovery mechanism such that it protects the identity of the person behind the email address.

Bob is correct that the account recovery mechanism is not designed to prevent an attacker from extracting side-channel information, e.g., guessing the email address behind the email address. So his complaint that their system design had a flaw which allowed his identity to be revealed is true.

That being said, his assumption that they should have closed that flaw is questionable. Gmail does not purport to provide anonymity, and that attack is not part of the threat model they've architected for. Which leads us to...

[Alice] thinks that in this case there is an inevitable trade-off between convenience and security.

Alice is correct that the trade-off between convenience and security explains the loophole she took advantage of. Gmail could just as easily ask people for their recovery address without the hint; it would be harder for people to remember which address they gave Gmail when they set the 2nd account up.

Gmail architected a usable system, and it is neither designed for, nor advertised as, providing effective anonymity. Caveat emptor.

  • "Gmail does not purport to provide anonymity" I see that, so you think that if Gmail guaranteed anonymity, then this incident would have been a flaw on their side, right? – today Nov 30 '18 at 15:49
  • 1
    @today if this flaw was found with, say, Hushmail, then yes, it would be more reasonable to complain that it should not have happened. Bob was assuming a level of protection that is not advertised or designed when he linked two Gmail accounts and expected that link to be impervious to detection. If he truly cared about anonymity, he wouldn't have set up recovery... and then there are still other ways (content analysis, web bugs, etc.) for him to be de-anonymized. – gowenfawr Nov 30 '18 at 15:55
  • Thanks for your answer. Now I see that which part of the argument of Bob is flawed. – today Nov 30 '18 at 15:59
0

Gmail's controls were set up to protect against random guessing. But Bob is not in a random threat scenario. Given the relationship between his account and the email, this lowers the necessity of random guessing. So, this enabled Alice to make a single correct guess.

Bob could have added his own controls, like adding a 3rd account example@example.com, make that the recovery email of carol@gmail.com and break the relationship between carol@gmail.com and his first initial.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.