7 ms·

I'm sorry, this sentence wasn't clear, and I agree with you. What I meant by this was: - Some would say that Netflix should verify the email address on sign up

I'm sorry, this sentence wasn't clear, and I agree with you. What I meant by this was: - Some would say that Netflix should verify the email address on sign up, but there's no obvious attack that this mitigates. Using someone else's address on signup only cedes account control to them. - Others would say that Netflix should disallow the registration of james.hfisher@gmail.com when a Netflix account already existed for jameshfisher@gmail.com. But this would force Netflix and every other website to have insider knowledge of Gmail’s canonicalization algorithm.

mikeyouse 9y ago
Does anyone else use dots in their email service? Wouldnt your second point be as simple as Netflix checking every gmail address against a dotless version of all of those addresses? Eg email-1 in the table is their address as input and email-2 is the dotless version, Netflix could then ensure that email-2 is unique. Seems pretty straight forward to accomodate an admittedly silly ‘feature’ of the largest email provider.
Buge 9y ago
> Some would say that Netflix should verify the email address on sign up, but there's no obvious attack that this mitigates. Someone could carry out this exact attack but without dots. The attacker creates an account, associates it with your email, and hopes you put your credit card info into the account. How come the attacker didn't "[cede] account control to [you]" when the attacker put your email into the attacker's account? The control issue seems the same regardless of how dots are treated.
- mrob 9y ago
  They couldn't carry out the same attack without the dots, because the attack relies on the target mistaking the attacker's Netflix account for their own account. If you get a Netflix email when you've never signed up using that email account then it's obviously not for you.
  - Buge 9y ago
    I have ~1000 online accounts. I can't remember every site that I've signed up for or not, and whether or not they've been deleted. Many websites allow multiple accounts to have the same email address.
    - ascorbic 9y ago
      You probably know whether you're paying for Netflix though.
xapata 9y ago
Why are dots special? I have several email addresses that all find my inbox. Heck, I've done this annoying identity split to myself by accident, creating two accounts with a product I only wanted one account for.
- djur 9y ago
  People can't automatically derive those other email addresses. The existence of xapata@somehost doesn't allow assuming the existence of xapata.spam@somehost, but the existence of xapata@gmail does allow assuming the existence of xa.pa.ta@gmail.
jsnell 9y ago
At least three people have successfully created a Netflix account with my gmail address, written in exactly the same way I would normally write it: Jessica in 2012, John in 2013, and Jen in 2017. The first two somehow managed to recover and change the email address, the last one never did. (So maybe it's now finally blocked off from further registrations.) If any of them had shared my name, the effect would have been just the same as in your case despite there being no canonicalization issues. Likewise would you really have been suspicious about seeing the notification come in for e.g. jamesfisher+netflix@gmail.com? Who can remember exactly what services they used a +something for? No. This hole is totally on Netflix. It's a total shitshow, especially for a company that loves to brag so much about how they only hire the best technical people. No. Either they don't hire the best, or they let some kind of piece of growth hackers actually run the show.
- jjeaff 9y ago
  I feel like you are being a bit harsh. What is really the exposure in this case? I can't really imagine that there are that many blackhats trying to get free Netflix accounts when torrents or Usenet gets you more content anyway. And while yes, there is some friction getting torrents, it's not nearly as much as trying to phish multiple people in hopes that they will pay for your account.
  - jsnell 9y ago
    All kinds of other problems follow from not verifying the emails, for both the person who owns the email account and the person owning the Netflix account. In addition to this kind of targeted attack: - When these accounts were active, I'd keep getting email from Netflix that I could not stop receiving. - In the first two cases, I could have done a password reset on the accounts and just started using them. The original owner would have to continue paying for it, since they'd have no way to disassociate the CC from the account. - In the third case the user didn't get the account back at all after forgetting their password (maybe no recovery phone number?). They lost all their viewing history and probably also ended up paying Netflix for service they had no way of using. From a technical perspective, this email handling is total garbage. The only persons winning are on growth hacker scumbags who get to write slides every quarter about how they lose no customers in the email verification part of the signup funnel.
shkkmo 9y ago
> but there's no obvious attack that this mitigates Anyone who owns fmail.com hmail.com gmil.com gmai.com can easily steal account details an personal information from people who have a typo when entering their email address if you don't verify the email address before sending that personal information. If you are not verifying an email address before sending sensitive content or allowing an account to access sensitive information, you are doing security wrong. edit: typo spelling typo...

mikeyouse 9y ago

Does anyone else use dots in their email service? Wouldnt your second point be as simple as Netflix checking every gmail address against a dotless version of all of those addresses? Eg email-1 in the table is their address as input and email-2 is the dotless version, Netflix could then ensure that email-2 is unique. Seems pretty straight forward to accomodate an admittedly silly ‘feature’ of the largest email provider.

Buge 9y ago

> Some would say that Netflix should verify the email address on sign up, but there's no obvious attack that this mitigates. Someone could carry out this exact attack but without dots. The attacker creates an account, associates it with your email, and hopes you put your credit card info into the account. How come the attacker didn't "[cede] account control to [you]" when the attacker put your email into the attacker's account? The control issue seems the same regardless of how dots are treated.

mrob 9y ago
They couldn't carry out the same attack without the dots, because the attack relies on the target mistaking the attacker's Netflix account for their own account. If you get a Netflix email when you've never signed up using that email account then it's obviously not for you.
- Buge 9y ago
  I have ~1000 online accounts. I can't remember every site that I've signed up for or not, and whether or not they've been deleted. Many websites allow multiple accounts to have the same email address.
  - ascorbic 9y ago
    You probably know whether you're paying for Netflix though.

xapata 9y ago

Why are dots special? I have several email addresses that all find my inbox. Heck, I've done this annoying identity split to myself by accident, creating two accounts with a product I only wanted one account for.

djur 9y ago
People can't automatically derive those other email addresses. The existence of xapata@somehost doesn't allow assuming the existence of xapata.spam@somehost, but the existence of xapata@gmail does allow assuming the existence of xa.pa.ta@gmail.

jsnell 9y ago

At least three people have successfully created a Netflix account with my gmail address, written in exactly the same way I would normally write it: Jessica in 2012, John in 2013, and Jen in 2017. The first two somehow managed to recover and change the email address, the last one never did. (So maybe it's now finally blocked off from further registrations.) If any of them had shared my name, the effect would have been just the same as in your case despite there being no canonicalization issues. Likewise would you really have been suspicious about seeing the notification come in for e.g. jamesfisher+netflix@gmail.com? Who can remember exactly what services they used a +something for? No. This hole is totally on Netflix. It's a total shitshow, especially for a company that loves to brag so much about how they only hire the best technical people. No. Either they don't hire the best, or they let some kind of piece of growth hackers actually run the show.

jjeaff 9y ago
I feel like you are being a bit harsh. What is really the exposure in this case? I can't really imagine that there are that many blackhats trying to get free Netflix accounts when torrents or Usenet gets you more content anyway. And while yes, there is some friction getting torrents, it's not nearly as much as trying to phish multiple people in hopes that they will pay for your account.
- jsnell 9y ago
  All kinds of other problems follow from not verifying the emails, for both the person who owns the email account and the person owning the Netflix account. In addition to this kind of targeted attack: - When these accounts were active, I'd keep getting email from Netflix that I could not stop receiving. - In the first two cases, I could have done a password reset on the accounts and just started using them. The original owner would have to continue paying for it, since they'd have no way to disassociate the CC from the account. - In the third case the user didn't get the account back at all after forgetting their password (maybe no recovery phone number?). They lost all their viewing history and probably also ended up paying Netflix for service they had no way of using. From a technical perspective, this email handling is total garbage. The only persons winning are on growth hacker scumbags who get to write slides every quarter about how they lose no customers in the email verification part of the signup funnel.

shkkmo 9y ago

> but there's no obvious attack that this mitigates Anyone who owns fmail.com hmail.com gmil.com gmai.com can easily steal account details an personal information from people who have a typo when entering their email address if you don't verify the email address before sending that personal information. If you are not verifying an email address before sending sensitive content or allowing an account to access sensitive information, you are doing security wrong. edit: typo spelling typo...