5 ms·
IMO It's not Netflix fault, actually emails with dots in different positions should be different emails. Also, not sending a confirmation email is a common patt
by aaossa 9y ago
IMO It's not Netflix fault, actually emails with dots in different positions should be different emails. Also, not sending a confirmation email is a common pattern now. Maybe an email about "you created an account :D" should be enough mitigation, but this is not their fault.
- fiddlerwoaroof 9y agoThe thing is, the handling of the local part is MTA specific: you cannot just assume that different local parts correspond to different people because of aliases, +foo addresses and the fact that the administrator of the MTA can set whatever equivalence rules they like: I, for example, use - instead of + because so many internet forms reject + as a valid email character. The only sane way to handle this is email-based confirmation.
- Pxtl 9y agoAs somebody who has multiple people who aren't me registering accounts to variations of my email address: Companies who do not send "you've created an account! Click here if you didn't!" emails can die in a fire.
- gcb0 9y agoIronically, the most i get of those emails is google itself They allow any idiot to register my gmail address as their "alternative recovery email" without confirmation. And then from time to time i get a dozen "recover your account" emails from those accounts.
- winkeltripel 9y agoThere should be an account creation email and another for a payment method being added. A lot of sites nag you to verify email but never force it.
- aaossa 9y agoYeah, another pattern I've seen is that confirmation is required just in case you need to provide a payment method.
- bad_user 9y ago> actually emails with dots in different positions should be different emails Don’t know from where this is coming from but there’s no such _should be_ rule, there never was. As a matter of fact an email server can have any aliasing setup it wants. FastMail for example does sub-domain aliasing, which is awesome because I can use an unique email address for any service I sign up to. Any email server or service worth its salt allows aliases. Which aren’t hard to guess for a determined attacker either. Netflix has no excuse ;-)
- Pxtl 9y agosubdomain aliasing sounds way better than + aliasing. Too many sites block + aliasing.
- gcb0 9y ago> Too many sites block + aliasing. You actually mean: Too many sites were coded by incompetent people and have broken input validation.
- bad_user 9y agoYes, unfortunately that's the truth. For example: meetup.com On an email with a plus in it, they complain with this exact error message: "This isn't a valid email address". I contacted their support a year ago. They replied that they've passed along my "feedback". Nothing happened since then. That said, plus aliasing is sort of a standard. And spammers could eliminate anything after the plus, its usage being pretty obvious, so you can't rely on it for tracing spam. Eliminating the aliasing is much trickier to do with sub-domains, as it's not at all clear when aliasing is used or not. And some email services support custom email routing based on your own regular expressions (e.g. GSuite) so you can come up with your own weird scheme. Plus aliasing is only fine when you don't have control for doing something better, more opaque. Like when you have a work or a @gmail.com address.
- brann0 9y agoNot confirming the email is insane. And it's even worse if you're going to use that email address to send personal data. I don't see any excuse to not confirm an email address, honestly.
- gcb0 9y agoI am not even sure what you are replying to. I never said opposite of "actually emails with dots in different positions should be different emails". I also strongly think so. Netflix suck for not letting the owner of the email know an account is associated with it in a much better way.