1

I cannot determine if my Gmail account is hacked. I am receiving spam from [email protected] which is identical to my own Gmail address [email protected] except for the dot before the @. How is that possible since the dots are irrelevant to Gmail?

  • I have tested this situation by using the spammer's email address of [email protected] to sign into my own Gmail account
  • Gmail labels the spam as coming from me, and they are received in the spam folder. In my inbox, in the "from" column, it says the emails are from "me", it uses the word "me", Gmail only uses the word me if I send an email to myself.
  • I am only referring to the email address inside the < >, not to anything outside it.
  • This problem has nothing to do with my previous questions which I posted approximately four weeks ago, since I had the Microsoft account at the center of those questions blocked and deleted by Microsoft (I assume), however, it could be a clue as to how today's problem may have been done, by using ........
11
  • 3
    Anyone can set sender field in the email to any email address they want. That's why if an email looks like sent from your address, it does not mean anything.
    – mentallurg
    Commented Apr 16, 2023 at 19:47
  • I am only referring to the email address inside the < > , not to anything outside it Commented Apr 16, 2023 at 20:09
  • Are you saying it's common for hackers to send email using other peoples email addresses without actually accessing their account Commented Apr 16, 2023 at 20:15
  • 2
    No, I am not saying anything about attacker. I am saying, anyone can do that. The fact that Gmail puts such emails to the spam folder indicates that this is just spam. There is no indicator that your account was hacked. You can change account password, and I think you will continue receiving such emails, which will confirm your account is not hacked.
    – mentallurg
    Commented Apr 16, 2023 at 21:01
  • 3
    Gmail uses word "me", because the the field "from" contains your email address. As I said, the sender cans set this field to any value, including your email address.
    – mentallurg
    Commented Apr 16, 2023 at 22:05

1 Answer 1

1

Emails are a VERY old protocols (SMTP). The fundamental securities of emails have not changed since its inception (read: no security).

I've worked on the behind-the-scenes format of email, and literally anyone can put in anything; it's just all plain text. I can put the "from" with anything I want.

There are practical strategies to deal with the lack of security. The mail servers will include information about where the mail came from. If the email is "from" your "[email protected]", but it was sent by the server "@badserver.com", then this raises suspicion, and would probably get rejected or flagged as spam. Also, if you use a reputable email service, they do not let you arbitrarily change the "from" address, but anyone with a domain can setup email servers (it costs effectively nothing to do this).

There are also a lot of security in place behind-the-scenes regarding whitelisting, server reputation, spam detection, etc., but all this is not relevant to the current topic.

3
  • - This question I have posted made me think about a possible type of solution that these webpage-based-email-services like Gmail could use, that would be that before sending the email your Gmail-signed-in-webpage would first send some type of mini-message to central Gmail-servers telling them that your Gmail-signed-in-webpage is about to send an email that using some algorithm results in some type of code/number/don't-know, so when they receive the email it has to result in the same code/number/don't-know that was in the mini-message sent just before the email. Commented Apr 17, 2023 at 2:39
  • I assume that obviously there are all sorts of solutions. Commented Apr 17, 2023 at 2:39
  • You already can't enter an arbitrarily "from" field in a web-based email service because there's no good use-case for this, so they don't let you to begin with. Best to just read up on the specification if you're interested. If you don't understand the specs, then just leave it to others to deal with it.
    – Nelson
    Commented Apr 17, 2023 at 3:04

Not the answer you're looking for? Browse other questions tagged .