1

Note: This is based on a true story!

The Story:

Alice and Bob are good friends and each one knows the personal email address of the other person and they contact with each other using it. Let's assume they are [email protected] and [email protected] for Bob and Alice, respectively.

Bob is a member of an online community (i.e. such as a forum) and he has put another email address of him, say [email protected], on his profile so that other users can contact him using it (that online community does not have a built-in message system for the users to contact with each other). Further, Bob has setup [email protected] as the recovery email address of [email protected]. And he has not (intentionally) put any other personal information on his profile that says this account belongs to Bob.

Alice knows that Bob is a member of this online community, however she doesn't know which account belongs to Bob. She suspects that this profile with the email address [email protected] on it belongs to Bob, but she is not sure of it. In order to confirm her suspicion, she comes up with this plan:

She goes to Gmail website, enter [email protected] as the email address and presses Forgot password? button. Then the following message is shown:

To get a verification code, first confirm the recovery email address you added to your account: "b********@example.com"

She enters [email protected] and then the following message is shown:

Please enter the verification code sent to [email protected] ...

That's it! She finds out that the account and email address belongs to Bob. She gets very excited and sends the following message to [email protected] as a result:

Ha ha! EXPOSED!

The Question:

Well, Bob is very furious at this. He argues that he has followed all the security guidelines and he has tried hard to not expose any of his personal information and identity. Rather, he blames email provider (i.e. Gmail) and says that they should have designed the account recovery mechanism such that it protects the identity of the person behind the email address.

On the other hand, Alice, at the same time being proud of her ingenious plan, thinks that in this case there is an inevitable trade-off between convenience and security. She says that Bob has setup the recovery email so that he does not worry about his password being forgotten by him, and in turn this has the side effect of revealing his identity.

Who is right here? If you think Bob is wrong, what should have he done to both secure his identity and his email (i.e. keep it recoverable)? And if you are on Bob's side and think it is the email provider's fault, how should have they implemented the recovery mechanism?

Further, note that I am not insisting that only one of the parties is right and the blame is on the other side. It might be that both parties are wrong or right as well. If you have other viewpoints, I would be glad to hear them.

Improve this question
6
  • You have not set up a proper dichotomy. Both parties can be correct.
    – schroeder ♦
    Nov 30, 2018 at 15:35
  • The level of the controls was not what Bob needed to accomplish his goal. But the level of the control is appropriate for the classified threat that was identified by the email provider. Security is not all or nothing. Controls need to be in line with the threats. Bob's threat's were bigger than the email provider's controls. No failures on either side.
    – schroeder ♦
    Nov 30, 2018 at 15:39
  • @schroeder Thanks for your comment. First and foremost, I must say that I am not a security expert at all. I am writing this from the viewpoint of completely normal users and their presented arguments (in real word). If you think that both parties could be correct I would appreciate if you could give your reasons as an answer or a comment. Additionally, you may add other viewpoints as well.
    – today
    Nov 30, 2018 at 15:39
  • Bob has linked an account which he wanted to be distinct from his main identity to his main identity. The mail provider provides a means of these being distinct - you create two accounts and use each as the other's recovery address, but where both are associated with the new identity.
    – Matthew
    Nov 30, 2018 at 15:43
  • Question: if prompted to enter the email address for b*****@example.com, if Alice were to enter "[email protected]", would the system respond in the same way and prompt for the verification code sent to [email protected]? That would be a more secure way to respond but I'm not sure whether that actually happens.
    – Ben
    Nov 30, 2018 at 16:33

2 Answers 2

Reset to default
2

Who is right here?

Both Bob and Alice are correct.

[Bob] blames email provider (i.e. Gmail) and says that they should have designed the account recovery mechanism such that it protects the identity of the person behind the email address.

Bob is correct that the account recovery mechanism is not designed to prevent an attacker from extracting side-channel information, e.g., guessing the email address behind the email address. So his complaint that their system design had a flaw which allowed his identity to be revealed is true.

That being said, his assumption that they should have closed that flaw is questionable. Gmail does not purport to provide anonymity, and that attack is not part of the threat model they've architected for. Which leads us to...

[Alice] thinks that in this case there is an inevitable trade-off between convenience and security.

Alice is correct that the trade-off between convenience and security explains the loophole she took advantage of. Gmail could just as easily ask people for their recovery address without the hint; it would be harder for people to remember which address they gave Gmail when they set the 2nd account up.

Gmail architected a usable system, and it is neither designed for, nor advertised as, providing effective anonymity. Caveat emptor.

Improve this answer
3
  • "Gmail does not purport to provide anonymity" I see that, so you think that if Gmail guaranteed anonymity, then this incident would have been a flaw on their side, right?
    – today
    Nov 30, 2018 at 15:49
  • 1
    @today if this flaw was found with, say, Hushmail, then yes, it would be more reasonable to complain that it should not have happened. Bob was assuming a level of protection that is not advertised or designed when he linked two Gmail accounts and expected that link to be impervious to detection. If he truly cared about anonymity, he wouldn't have set up recovery... and then there are still other ways (content analysis, web bugs, etc.) for him to be de-anonymized.
    – gowenfawr
    Nov 30, 2018 at 15:55
  • Thanks for your answer. Now I see that which part of the argument of Bob is flawed.
    – today
    Nov 30, 2018 at 15:59
0

Gmail's controls were set up to protect against random guessing. But Bob is not in a random threat scenario. Given the relationship between his account and the email, this lowers the necessity of random guessing. So, this enabled Alice to make a single correct guess.

Bob could have added his own controls, like adding a 3rd account [email protected], make that the recovery email of [email protected] and break the relationship between [email protected] and his first initial.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .